> ## Documentation Index
> Fetch the complete documentation index at: https://zenskar.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor authentication

## 1. Concepts

### What two-factor authentication does

Two-factor authentication (2FA) requires a time-based one-time passcode from an authenticator app in addition to a password when signing in. Enabling it for a user makes this second step mandatory at their next sign-in.

### Who can enable it

2FA is enabled per user from their row in the **Users** module. It requires the Update permission on the Users module, the same permission needed to edit that user's profile. By default, only the admin role has it.

<Warning>
  Enabling 2FA is one-way: Zenskar has no option to disable it afterward. Contact [help@zenskar.com](mailto:help@zenskar.com) to disable 2FA for a user.
</Warning>

### Enrollment

Once required, the authenticator app setup (QR code or manual entry) happens through Zenskar's identity provider at the user's next sign-in.

***

## 2. How-to guides

### Enable 2FA for a user

1. Go to **Users**.
2. Open the user's row kebab menu, and select **Enable 2 Factor Authentication**.
3. Confirm.

The user sets up an authenticator app at their next sign-in. The same steps work on your own row.

### Troubleshooting

* **The action fails with an error**: enabling 2FA requires the Update permission on the Users module. The action itself is always visible; without this permission, it fails on click rather than being hidden or disabled.
* **User stuck at setup**: enrollment runs on the identity provider's sign-in flow. Confirm they have a TOTP app installed, and have them retry.
* **Need to disable 2FA for a user**: contact [help@zenskar.com](mailto:help@zenskar.com).

***

## 3. Reference

### Location

Users module, row kebab menu.

### Fields

| Field                          | Notes                                                       |
| ------------------------------ | ----------------------------------------------------------- |
| Enable 2 Factor Authentication | Requires the Update permission on the Users module. One-way |

### Undocumented

| Item                             | Status        |
| -------------------------------- | ------------- |
| Authenticator apps supported     | Not published |
| TOTP algorithm, digits, interval | Not published |