---
title: "Let organisations require a second factor · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy
updated: 2026-10-20
licence: "All rights reserved"
---

# Let organisations require a second factor

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)
- Rule: Let organisation owners require a second factor for every member, and hold members without one at a setup page.
- How: Store the policy on the organisation and check it before any of its pages load. Give members at most 7 days of grace, then allow only the setup page. Show owners each member's factor types, never secrets. A business single sign-on that already asks for a second factor can count, when it reports so in the `amr` or `acr` claim.
- Check: Turn the policy on for a test organisation. After the grace period, a member without a second factor reaches only the setup page. A member with a passkey works as before.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy`.

- Previous: [Never use security questions](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions)
- [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)