Security settings — two-factor for the whole practice

Settings → General → Security holds the sign-in rules for the whole practice. Today there is one rule: whether every employee must use two-factor sign-in — a 6-digit code from an authenticator app after the password.

The page is under the General group of the settings menu, next to Integrations and Appointment. You need access to Settings to open it.

The switch

The Two-factor sign-in card has one switch: Require two-factor sign-in for everyone (web).

Under it a coloured line tells you the current state:

• Off — two-factor is required only for employees marked "MFA required" (Employees → employee → User Details) and for those who turned it on themselves. Everyone else signs in with the password only.
• On — two-factor sign-in is required for every employee on the web.

Requiring two-factor for everyone

1. Talk to staff first. Everyone needs an authenticator app on their phone — Google Authenticator, Microsoft Authenticator, Authy or similar — and has to have the phone with them the next time they sign in.
2. Open Settings → General → Security and flip the switch on.
3. A window asks Require two-factor sign-in for everyone? and explains who is affected. Press Require for everyone (or Cancel to leave things as they are).
4. A green message confirms: Two-factor sign-in is now required for everyone on the web.

What staff notice:

• People who already use two-factor see no change.
• Everyone else is taken through Set up two-factor sign-in — scan a QR code, type the first code, save recovery codes — the next time they sign in with their password.
• Nobody can switch two-factor off for themselves any more. Their Account shows required for everyone by your organisation, and the Turn off button is gone.

The mobile app is not affected — it uses biometrics.

Making it optional again

1. Flip the switch off.
2. The window asks Make two-factor sign-in optional? — two-factor stays only for employees marked "MFA required" and for those who turned it on themselves.
3. Press Make optional. The message reads Two-factor sign-in is optional again.

How it fits with the employee checkbox

Each employee record has its own MFA required box (Employees → employee → User Details → Two-factor sign-in). The two work together:

• This switch on — everyone needs two-factor, whatever the box says. The employee card points this out: Settings → Security requires two-factor for everyone, so this employee needs it either way. (That line only shows to people who can open Settings.)
• This switch off — only people with the box ticked are made to use it.

Use the per-employee box when you only want two-factor for a few people — managers, billing staff, anyone who can see the most. Use this switch when you want it for everybody.

If someone loses their phone, the fix is on their employee record, not here: Reset MFA. See Two-factor sign-in.

Good to know

• Plan the day you switch it on. Anyone without a phone at their next sign-in cannot get in until they have one.
• Front-desk PIN sign-in changes too. With two-factor on, the Express Login PIN only works on a browser where the person once signed in with password and code and ticked Remember this device. Do that on each shared front-desk computer.
• If the page cannot load the setting, it shows an error with a retry button instead of the switch.

Related

• Two-factor sign-in
• Signing in
• Employees — accounts, time cards and schedule
• Settings — the lists the rest of the system chooses from