Requiring Multi-Factor Authentication
Admins can require multi-factor authentication (MFA) for their whole company, or just for privileged roles. When MFA is required, users must confirm a one-time code from an authenticator app after their password, and anyone who has not set that up yet is walked through it before they can reach the app.
This guide is for admins. Individual users set up their own authenticator app from Profile & Settings.
Where to find it
- Open the product switcher at the top of the sidebar and choose Workspace settings.
- Open Security and sign-in (
/admin/workspace/security). - Find the Authentication section.
The Back to link under the product switcher (for example, Back to People) returns you to the product you came from.
A banner at the top of the page always shows the current state: MFA not active, MFA enforced for admin and HR roles only, or MFA enforced on every login.
The two settings
You have two mutually exclusive choices, plus the option to leave MFA off:
| Setting | Who must use MFA |
|---|---|
| Require MFA for all employees | All users when their sign-in method requires a separate code |
| Require MFA for Admin / HR roles only | People who can manage company settings, including Super Admin, HR Admin, IT Admin and equivalent custom roles |
| (both off) | No one is forced by this setting; users may still opt in themselves |
Admin-only enforcement follows the permission to manage company settings, not the role's name. A passkey already provides strong authentication and does not ask for a separate authenticator code. Federated sign-in follows the company's setting for local MFA after SSO.
Turning one on turns the other off, so you are always in exactly one mode.
What happens at sign-in
When MFA is required for a user, their sign-in gains one step:
- They enter their email and password.
- If they already have an authenticator app set up, they enter the current 6-digit code to finish signing in.
- If they have not set one up yet, they are taken to a short enrollment screen. They scan a QR code with an authenticator app and enter a code to confirm. Their backup codes are then shown once, with Copy and Download buttons, and they tick I have saved these codes to continue. They cannot reach the app until this is done.
MFA here means a time-based code from an authenticator app such as Google Authenticator, Microsoft Authenticator, or Authy.
Users who are already signed in keep their current session. The requirement applies the next time they sign in.
Protect yourself from a lock-out
Set up your own authenticator app before you require MFA for admins. As a safeguard, Sparko will not let an admin who is out of compliance change this policy, so an admin without MFA cannot turn the requirement on and then get stuck behind it.
Every user gets backup codes during enrollment, shown only once. Remind your team to store them somewhere safe in case they lose their phone. Anyone who loses theirs can issue a new set from Account Settings > Security > Regenerate backup codes; the old set stops working.
Saving
The Save changes button at the bottom of the page only sends the fields you actually changed. The unsaved-changes dot turns amber until you save.
Related guides
- Workspace Settings Overview: every settings surface at a glance
- First Login Guide: the MFA setup steps users follow
- Signing In With a Passkey: a phishing-resistant alternative
Still need help? Reach us at [email protected].
← Back to Help Center