# Require two-factor sign-in for your workspace

> Make everyone who signs in to your workspace with a password also use a code from their phone.

Source: https://docs.soosh.io/guides/workspace/require-two-factor-sign-in/

## Before you start

- [You're the workspace owner](https://docs.soosh.io/guides/workspace/transfer-ownership/)
- [Two-factor sign-in is on for your own account](https://docs.soosh.io/guides/workspace/turn-on-two-factor-sign-in/)

Soosh asks you to turn on your own first, so you can't lock yourself out. If you sign in
only with Google or your company's sign-in, you don't need it: you're never
asked for a code, so you can turn the requirement on straight away.

## Turn it on

1. Go to [**Settings > General**](https://app.soosh.io/settings) and find **Security**.
2. Turn on **Require two-factor sign-in**. It saves at once.

## Result

Members who sign in with a password must use two-factor sign-in. Anyone
without it is asked to turn it on the next time they open the workspace.
Until they do, they can only turn it on, switch to another workspace or sign
out.

- Under the switch, click **See who** to open [**Settings > Members**](https://app.soosh.io/settings/users) with only the members who still need it, each with a **Needs two-factor** badge.
- Single sign-on isn't affected. Members who sign in with Google or their company's sign-in carry on as before.
- API keys keep working. Keys made by members without two-factor sign-in
  are listed under the switch. Check them in
  [**Settings > API keys**](https://app.soosh.io/settings/api-keys) and remove any you don't need.

> **Note:** Members can move two-factor sign-in to a new phone themselves, in **Profile**
> with **Use a new phone**, using their old phone or a recovery code. If they have neither, they write to the support address under **Trouble signing in?** on the sign-in page. You can't reset it from the workspace. Until then they can sign in with a code sent by email, unless they reset their password or changed their sign-in email in the last 7 days.

To stop requiring it, turn the switch off. Every change shows in the audit
log.

## Related

- [Turn on two-factor sign-in](https://docs.soosh.io/guides/workspace/turn-on-two-factor-sign-in/)
- [Read the audit log](https://docs.soosh.io/guides/workspace/read-the-audit-log/)
- [Sign in with single sign-on](https://docs.soosh.io/guides/workspace/sign-in-with-single-sign-on/)