Enforce MFA for your team

You can require multi-factor authentication (MFA) for all members of a team, or for every member of your organization. When you turn on enforcement, you choose how strictly it’s applied: a persistent banner that reminds members to set up MFA, or a full lockout once a 14-day grace period ends.

Where to enforce MFA

MFA enforcement is available at two levels:

Level	Where	Who can change it
Team	Team Settings > General, under MFA enforcement	Team editors and organization administrators
Organization	Organization Settings > Security, switch Require MFA for all members	Organization administrators

Organization-level enforcement overrides the team switch. When your organization enforces MFA, the team switch is locked on and shows the tooltip “MFA is enforced at the organization level. Team-level settings cannot override this.”

Enable MFA enforcement for a team

1. Open team settings or navigate to Team Settings > General
2. Under MFA enforcement, turn the switch on
3. In the Enable MFA enforcement? dialog, choose Banner or Lockout
4. Click Enable

Anyone with permission to manage the team can change this setting, so team editors as well as organization administrators. Team viewers can see the switch but cannot change it.

Enable MFA enforcement for the whole organization

1. Open organization settings or navigate to Organization Settings > Security
2. Turn on Require MFA for all members
3. In the Enable MFA Enforcement? dialog, choose Persistent banner or Full lockout
4. Click Enable

Only organization administrators see the Security tab. Once enabled, the page shows the active mode as a badge and the days left in the grace period.

Enforcement modes

Both levels offer the same two modes, labeled Banner / Lockout on the team switch and Persistent banner / Full lockout on the organization page.

Banner

Members without MFA see a persistent banner at the top of the dashboard prompting them to set it up. They can still use every feature while the banner is showing. Use this mode to encourage adoption without disrupting your team’s work.

Lockout

Members without MFA see the same banner during the grace period. Once the grace period ends, they are locked out of the dashboard until they complete MFA setup. Use this mode when your security policy requires MFA and you need a firm deadline.

To switch modes, turn enforcement off and back on and pick the other mode in the dialog.

The 14-day grace period

Every member gets 14 days to set up MFA before lockout applies. The grace period starts from whichever is later: the date enforcement was enabled, or the date the member joined the team or organization. A member invited after enforcement is turned on gets their own 14 days from the day they join.

During the grace period, members always see the banner, whichever mode you chose. After it ends, the configured mode applies. When a member is covered by more than one enforcement (for example both their organization and a team), the strictest mode and the earliest deadline win.

What happens when MFA is enforced

• Members who already have MFA enabled can log in as normal, regardless of mode
• Members without MFA see a banner prompting them to set up MFA
• In lockout mode, members who haven’t set up MFA when their grace period ends are locked out until they complete setup
• Turning enforcement off takes effect immediately and clears the grace period

All enforcement changes are recorded in audit logs.

Supported MFA methods

Both MFA methods work with enforcement:

• Authenticator apps - Authy, Google Authenticator, 1Password, and other TOTP apps
• Hardware security keys - YubiKeys and other FIDO2 devices

Team members can choose either method during setup. For step-by-step instructions, see How to set up MFA.

Best practices

• Give your team a heads-up first. Share the MFA setup guide before turning enforcement on so people can get set up on their own time.
• Start with the banner. Run banner mode for a couple of weeks, then switch to lockout once most members have completed setup.
• Recommend backup methods. Having both an authenticator app and a hardware key prevents lockouts if one method is unavailable.
• Check audit logs. After enabling enforcement, use audit logs to confirm members are completing setup.