Two-factor authentication asks staff for a six-digit code after their password. As an HR administrator you decide whether your whole staff uses it, see who has set it up, and help people who are locked out.
The setting
/{slug}/app/settings/workspace → Require two-factor authentication for all staff. It is on by default.
- On: every staff member and trainer in the workspace is asked for a code at sign-in. Anyone who has not set it up is walked through setup at their next sign-in. There is no deadline and no email blast.
- Off: staff who never set up two-factor sign in with their password alone. Staff who did set it up keep using it until they turn it off themselves from their profile. HR administrators always use it.
Candidates are never asked for a code, whatever the setting.
When you turn the setting on, current staff sessions end and everyone enters a code at their next sign-in (your own session continues, since you are always challenged). Every change, on or off, is recorded in the audit trail. Only HR administrators can change it.
The MFA column on the team list
/{slug}/app/settings/team shows an MFA badge next to each member (visible to HR administrators):
| Badge | Meaning |
|---|---|
| App | The person uses an authenticator app. |
| Not enrolled | The person has not set up the app yet; they will be asked at next sign-in. Until then they may sign in with a one-time emailed code, which is never saved as their method. |
Candidates show no badge.
Resetting a user
If someone loses their phone and cannot use an emailed code either, reset their two-factor from the same list: use the reset button beside their MFA badge, then confirm.
- It removes their authenticator app, forgets their trusted devices and ends their live sessions. Their password is unchanged.
- At their next sign-in they set up two-factor again.
- The person receives an email about the reset, and the action is recorded in the audit trail with who did it.
- You cannot reset your own two-factor from the list; use your profile instead (see Two-factor authentication). Any other HR administrator of the workspace can reset you, and you can reset them.
If the last HR administrator is locked out, the Jadiroon platform operator can restore access. Every reset notifies the person; a break-glass reset (when no HR administrator is left to do it) also notifies all active HR administrators of the workspace.
What your people see
After the password, a code screen: the authenticator code, or an emailed code for that sign-in only, with a "Trust this device for 30 days" option. First-time users see app setup first, with Email me a code this time for one sign-in (no trusted device; setup is offered again next time). The authenticator app is the only method anyone keeps. HR administrators get no email option at setup: they must set up the app at their first sign-in. Everything they need is in Two-factor authentication.
Next
See Workspace settings for the other settings on the same card.