> ## Documentation Index
> Fetch the complete documentation index at: https://docs.planeconnection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Manage Two-Factor Authentication

> Enable and enforce two-factor authentication (2FA) for your workspace to strengthen account security.

This guide explains how to enable, configure, and enforce two-factor authentication for users in your PlaneConnection workspace.

<Warning>
  This feature requires **administrator** or **workspace owner** permissions. Changes made here
  affect all users in your workspace.
</Warning>

<Info>
  **Who should read this:** Workspace administrators responsible for security policy.

  **Prerequisites:** Admin or Account Owner role.
</Info>

## Why enforce 2FA

Two-factor authentication adds a second verification step beyond passwords, protecting your workspace even if a user's password is compromised. For Part 135 operators handling safety-sensitive data, 2FA helps satisfy the access control expectations of 14 CFR Part 5 safety data protection.

## Configure 2FA settings

Navigate to **Settings > Security > Two-Factor Authentication**.

### 2FA policy options

| Policy                  | Description                                                            |
| ----------------------- | ---------------------------------------------------------------------- |
| **Optional**            | Users can choose to enable 2FA on their own. No enforcement.           |
| **Recommended**         | Users see a prompt to enable 2FA at sign-in but can dismiss it.        |
| **Required for admins** | Admin and Account Owner roles must have 2FA. Other roles are optional. |
| **Required for all**    | Every user must set up 2FA before accessing the workspace.             |

### Supported 2FA methods

PlaneConnection supports multiple second-factor methods:

| Method                   | Description                                                                                                           |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------- |
| **Authenticator app**    | Time-based one-time passwords (TOTP) from apps like Google Authenticator, Authy, or 1Password.                        |
| **Passkeys**             | Biometric or hardware-based authentication (fingerprint, Face ID, security keys). Must be enabled for your workspace. |
| **Device authorization** | Trusted device approval flow. Must be enabled for your workspace.                                                     |

## Enable 2FA enforcement

<Steps>
  ### Choose a policy

  Select your desired 2FA policy from the dropdown on the Two-Factor Authentication settings page.

  ### Set a grace period

  If switching from **Optional** to **Required**, set a grace period to give users time to set up their second factor:

  | Grace period | Behavior                                           |
  | ------------ | -------------------------------------------------- |
  | **None**     | Users must set up 2FA immediately on next sign-in. |
  | **7 days**   | Users are prompted but can skip for up to 7 days.  |
  | **30 days**  | Users are prompted but can skip for up to 30 days. |

  ### Save and notify

  Click **Save**. Users who need to set up 2FA receive an email notification with instructions.
</Steps>

<Tip>
  Start with **Required for admins** before rolling out to all users. This ensures your most
  privileged accounts are protected first while giving other users time to prepare.
</Tip>

## Manage passkeys

If passkeys are enabled for your workspace, users can register hardware security keys or platform authenticators (Touch ID, Windows Hello) as their second factor.

Navigate to **Settings > Security > Passkeys** to view passkey enrollment status across your workspace:

* Number of users with passkeys registered
* Users with no second factor configured
* Recent passkey registrations

## Reset a user's 2FA

If a user loses access to their second factor (lost phone, broken security key):

1. Navigate to **Settings > Members** and find the user.
2. Click **Edit** on their profile.
3. Click **Reset 2FA**. This removes all registered second factors for the user.
4. The user must set up 2FA again on their next sign-in.

<Warning>
  Resetting a user's 2FA removes all their registered authenticators and passkeys. They will need to
  re-register from scratch. Only do this after verifying the user's identity through an out-of-band
  channel (phone call, in-person verification).
</Warning>

## Related

<CardGroup cols={2}>
  <Card title="Manage Security" href="/en/how-to/admin/manage-security">
    Broader security settings including session policies.
  </Card>

  <Card title="Configure SSO" href="/en/how-to/admin/configure-sso">
    Set up single sign-on alongside 2FA.
  </Card>

  <Card title="Permissions Matrix" href="/en/reference/permissions">
    Role-based access control details.
  </Card>
</CardGroup>