--- title: "Force Two-Factor Authentication for an Organization" slug: "force-two-factor-authentication-for-an-organization" description: "Enhance your organization's security with two-factor authentication (2FA) in The Staff Center. Ensure user identity verification at sign-on for added protection." updated: 2026-07-28T14:26:29Z published: 2026-07-28T14:26:29Z canonical: "www.civicplus.help/force-two-factor-authentication-for-an-organization" --- > ## Documentation Index > Fetch the complete documentation index at: https://www.civicplus.help/llms.txt > Use this file to discover all available pages before exploring further. # Force Two-Factor Authentication for an Organization The Staff Center, formerly CivicPlus Organizations, supports organization-level two-factor authentication, or 2FA, to improve security for [single sign-on](/civicplus-help-center/docs/two-factor-sign-in). This standard security method requires users to enter a password and a second form of verification, such as an authenticator app, to confirm their identity at sign-on. > [!NOTE] > Important Notes: > > - Once enabled, all [users in your organization](/civicplus-help-center/docs/add-manage-users) will be [prompted with instructions](/civicplus-help-center/docs/two-factor-sign-in) at their next sign-on. This includes users who have 2FA turned off on their individual accounts. > - Before enabling, review your list of organization users and [add or remove users](/civicplus-help-center/docs/add-manage-users) as needed. You can also [Automatically Add Users to an Organization by Domain](/civicplus-help-center/docs/automatically-add-users-to-an-organization-by-domain). > - If a user is associated with multiple organizations, such as a city and a county, 2FA will be required if either organization enables it. > - This setting applies only to organizations that **do not use** a [platform identity provider](/civicplus-help-center/docs/about-platform-idp-identity-provider-integrations). > [!TIP] > Who can use this feature? > > Organization Owners ## Instructions [Embedded content](https://www.iorad.com/player/2113425/CivicPlus-Organizations--How-to-Force-Two-Factor-Authentication-for-an-Org-Practice-Tutorial) 1. Sign in to the [Staff Center](https://staffcenter.civicplus.com/) 2. Navigate to **Organization** **Settings**![CivicPlus Staff Center dashboard with highlighted Organization Settings option.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Organization Settings - STCE.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 3. Scroll down to the **Security** section and toggle on **Force Two-Factor Authentication**![Settings for enforcing Two-Factor Authentication for CivicPlus users in an organization.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Force%20Two-Factor%20Authentication%20-%20STCE.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 4. If needed, [add a domain](/civicplus-help-center/docs/automatically-add-users-to-an-organization-by-domain) to automatically add users with email addresses matching the associated domain(s) to your organization ![Toggle for automatically adding users to an organization by their email domain.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Automatically Add Users to Organization by Domain - STPO.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 5. Click **Save**![Civic City Staff Center displaying Organization Settings with a prominent save button.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Save Organization Settings - STCE.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 6. Once enabled, the next time users log in, they will be prompted to **Enable an Authenticator App** (recommended) or **Enable Email Authentication** ![Select your Multi-Factor Authentication method, either authenticator app or email authentication.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Select%20Multi-Factor%20Authentication%20Method%20-%20SSO.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 7. The user will then follow the setup instructions for the method they selected - **Authenticator App:** 1. Scan a QR code and set up the 2FA app of their choice![Instructions for configuring a two-factor authenticator app with QR code and key.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Configure%20Authenticator%20App%20-%20STCE.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 2. Users will also see a list of **Recovery Codes** for their account in case they ever lose access to the app. **We highly recommend users save these codes**:![Recovery codes for account access after verifying the authenticator app.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Recovery%20Codes%20-%20STCE.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) - **Email:** 1. An email will be sent to their account’s email address. They will copy the code from the email. ![CivicPlus email showing a sign-in request with a highlighted authentication code.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Email%20Verification%20Code%20for%202FA%20-%20SSO.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 2. The user will paste the **Authentication Code** from their email and click **Verify**. ![Email authentication setup with a prompt for entering a verification code.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Configure%20Email%20Authentication%20-%20SSO.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 3. The user will then receive a new email verification code, which they must enter to confirm their login. ![Email authentication verified, enter the six-digit code to sign in.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/Enter%20Email%20Code%20After%20Confirming%20Verification%20-%20SSO.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) 8. [Signing in](/civicplus-help-center/docs/two-factor-sign-in) will now require two-factor authentication every time the user logs in > [!WARNING] > Note: > > A note will display on the [user’s account](/civicplus-help-center/docs/set-up-two-factor-authentication-on-an-account) that two-factor authentication is required for their organization. If they try to disable or reset their 2FA settings, they will be prompted to re-enable 2FA the next time they sign in. ![Two-factor authentication is required for secure login by your organization.](https://cdn.us.document360.io/17dc564a-8310-4f61-b929-1bd73b36e158/Images/Documentation/2FA%20Required%20by%20Organization%20-%20SSO.png?sv=2026-02-06&spr=https&st=2026-10-29T08%3A13%3A24Z&se=2026-10-29T09%3A13%3A24Z&sr=c&sp=r&sig=wK7VnQWz31RmKRxlh3hzLcw22Kc1h4V1NaYRvk6Mh4c%3D) Two-Factor Authentication. Quick Response