Agent Wranglers

Second factors and recovery Recommended

Let organisations require a second factor

Let organisation owners require a second factor for every member, and hold members without one at a setup page.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Store the policy on the organisation and check it before any of its pages load. Give members at most 7 days of grace, then allow only the setup page. Show owners each member's factor types, never secrets. A business single sign-on that already asks for a second factor can count, when it reports so in the amr or acr claim.

How to check

Turn the policy on for a test organisation. After the grace period, a member without a second factor reaches only the setup page. A member with a passkey works as before.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy.