Two-factor requirement
When every member of a workspace needs a second factor — and what happens when you switch it on.
Settings → „Sicherheit & SSO“ (Security & SSO) opens with the card „Zwei-Faktor-Authentifizierung“ (Two-factor authentication). That is where it is decided whether every member of this workspace needs a second factor.
Owners and admins may read and change it. Every other role gets a „not found“ page.
The signed-in product speaks German, so its labels are quoted in German throughout, with the English rendering in italics.
The factor itself belongs to the personal account, not to the workspace — it is set up under My account and applies everywhere. This page only decides whether this workspace requires it.
What the switch does
With the requirement on, any member without a second factor is taken to a setup page the next time they enter. They scan a QR code with an authenticator app, confirm once with a six-digit code and receive their recovery codes. Then they carry on where they were going.
Nobody is locked out. The setup is the way in, not a door closing.
The requirement applies to owners too. There is no exemption by role.
What it does not do
- Signing in is unchanged. E-mail and password still work; the requirement applies to entering this workspace.
- Other workspaces are unaffected. Somebody who is a member of two, and meets the requirement in one, carries on unchanged in the other — with the same account.
- Existing factors are left alone. Anyone who already has one notices nothing.
Before switching it on
Above the switch is how many active members already have a second factor — „3 von 7 Mitgliedern haben Zwei-Faktor eingerichtet“ (3 of 7 members have two-factor set up).
The confirmation dialog states the same figure from the other side: how many will be taken through setup the next time they enter. Both count active memberships only; deactivated ones are left out.
A workspace where nobody has a factor yet can still be switched on — everyone sets one up on their next visit.
Switching it off
One click, no confirmation. The switch stays usable even if the plan no longer includes the requirement: whatever was switched on can always be switched off.
Switching off removes no factors. Members keep what they set up; it is simply no longer required.
Plan
The two-factor requirement is included in Starter and Growth. On the free plan it cannot be switched on — the switch states the reason.
When the authenticator app is gone
A recovery code helps (see My account). Redeeming one turns two-factor sign-in off and signs you out. On the next sign-in the workspace takes you to setup, so you create a new second factor rather than being left without one.
If the recovery codes are lost as well, only verstag support can lift the requirement for the workspace.