Mandatory workspace two-factor authentication

For an added layer of security, you can require your members and guests to use two-factor authentication (2FA) when they sign in to Slack.

How 2FA works

  • Members and guests will get a verification code sent to their mobile device.
  • To sign in, they'll enter their verification code along with their password.
  • Members and guests will need access to enter a verification code that is sent to their mobile device every time that they sign in.

Note: If you're using single sign-on (SSO), mandatory 2FA should be set up through your identity provider.


Turn on mandatory 2FA

Free, Standard and Plus subscriptions

Enterprise Grid subscription

Workspace owners and admins can make 2FA mandatory for members of their workspace:

  1. From your desktop, click on your workspace name in the top left.
  2. Select Settings & administration from the menu, then click on Workspace settings.
  3. Click on Authentication
  4. Next to Workspace-wide two-factor authentication, click on Expand.
  5. Click on Activate two-factor authentication for my workspace, then enter your password.
  6. If you want, you can customise the Slackbot message for your members.
  7. Click Activate two-factor authentication. Members will get an email and Slackbot message to help them to set up authentication. 

    Members who don't set up 2FA within 24 hours will be signed out of Slack and prompted to set up 2FA before they can sign in again. New members will be required to set up 2FA before creating an account and signing in to Slack.

Org owners and admins can make 2FA mandatory for any workspaces in their Enterprise Grid org:

  1. From your desktop, click on your workspace name in the top left.
  2. Select Settings & administration from the menu, then click on Organisation settings.
  3. Select  Security from the left sidebar, then click on Security settings.
  4. Click onTurn on Mandatory 2FA.
  5. If you want, you can customise the Slackbot message for your members.
  6. Click Turn on Mandatory 2FA. Members will get an email and a Slackbot message to help them to set up authentication.

    Members who don't set up 2FA within 24 hours will be signed out of Slack and prompted to set up 2FA before they can sign in again. New members will be required to set up 2FA before signing in to Slack.

Tip: Visit our Set up two-factor authentication article for step-by-step instructions for setting up 2FA for your account.

 

See who has 2FA set up

Free, Standard and Plus subscriptions

Enterprise Grid subscription

Workspace owners and admins can see which members have 2FA set up:

  1. From your desktop, click on your workspace name in the top left.
  2. Select Settings & administration from the menu, then click on Manage members.
  3. Select Filters in the top right.
  4. Below Authentication, tick the box next to Two-factor (2FA).

Workspace owners and admins of workspaces in an Enterprise Grid org can see which of their members have 2FA set up:

  1. From your desktop, click on your workspace name in the top left.
  2. Select Settings & administration from the menu, then click on Manage members.
  3. Select Filters in the top right.
  4. Below Authentication, tick the box next to Two-factor (2FA).

Note: You can only see who has 2FA enabled at the workspace level at this time.

 

Restore access for locked-out members

Free, Standard and Plus subscriptions

Enterprise Grid subscription

If a member gets locked out, workspace owners and admins can temporarily turn off 2FA for that person. On their next sign-in attempt, they'll be prompted to set up 2FA again. Here's how to turn off 2FA for a member:

  1. From your desktop, click on your workspace name in the top left.
  2. Select Settings & administration from the menu, then click on Manage members.
  3. Click on the  three dots icon to the right of the member's name.
  4. Choose Disable 2FA.

Note: Only the workspace primary owner can turn off 2FA for workspace owners. Only workspace owners can turn off 2FA for workspace admins.

If a member gets locked out, org owners and admins can temporarily turn off 2FA for that person. On their next sign-in attempt, they'll be prompted to set up 2FA again. Here's how to turn off 2FA for a member:
  1. From your desktop, click on your workspace name in the top left.
  2. Select Settings & administration from the menu, then click on Manage members.
  3. Click on the  three dots icon to the right of the member's name.
  4. Choose Disable 2FA.

 

Use 2FA with single sign-on

Standard and Plus subscriptions

Enterprise Grid subscription

Workspace owners and admins can set up 2FA alongside SAML single sign-on (SSO). To do so, make sure to set up 2FA with your identity provider. If you're using Google authentication with Slack, set up two-step verification with Google. 

What to expect

  • Workspace owners must set up 2FA for themselves to keep their backup password secure. 
  • Guests must set up 2FA if they are not required to use SSO. 
  • On workspaces where SSO is optional, members can use SSO or their email address and password to sign in to Slack. These members will also be notified when workspace-wide 2FA is turned on.
  • 2FA in Slack will be turned off when a member connects or binds their SSO account.
In an Enterprise Grid org, workspace owners and admins can set up 2FA alongside SAML single sign-on. To do so, make sure to set up 2FA with your identity provider. If you're using Google authentication with Slack, set up two-step verification with Google.

What to expect

  • Workspace owners must set up 2FA for themselves to keep their backup password secure.
  • Guests must set up 2FA if they are not required to use SSO. 
Who can use this feature?
  • Workspace owners/admins and org owners/admins
  • FreeStandardPlus and Enterprise Grid subscriptions