> ## Documentation Index > Fetch the complete documentation index at: https://help.cloudtalk.io/llms.txt > Use this file to discover all available pages before exploring further. # Require Two-Factor Authentication for Your Account > Require two-factor authentication for your whole account, allow strong methods only, and reset 2FA for locked-out users. > [!NOTE] > > As an admin, you can require two-factor authentication (2FA) for everyone in your CloudTalk account, allow only the strongest methods, and help people who are locked out. **User level:** Admin *** ## Require two-factor authentication 1. In the Dashboard, go to **Settings > Two-Factor Authentication**. 2. Under **Account policy**, turn on **Require two-factor authentication**. From then on, everyone who signs in with a password needs a second step. * **There is no grace period.** Anyone without a method is asked to set one up at their next sign-in, and can't get into CloudTalk until they do. * **People already signed in aren't signed out.** They see a banner asking them to set up a method on their Profile before their next sign-in. * **SSO users aren't affected.** People who sign in through your identity provider (Google, Microsoft, Okta, and others) are covered by it already and aren't asked again. > [!NOTE] > > New CloudTalk accounts have **Require two-factor authentication** turned on from the start. For existing accounts, it's off until an admin turns it on. ## Allow strong methods only Under **Account policy**, turn on **Strong methods only** to turn off the email code for everyone. People then sign in with an authenticator app or a passkey. * You can only turn it on if you have an authenticator app or a passkey yourself. * People who only have the email code keep working, and are asked to set up an authenticator app or passkey the next time they need a second step. * Email is the method most people start with, and the one they fall back on when they lose a device. Without it, someone who loses their only device needs an admin to reset their 2FA. * If you turn the policy off again, email codes work again straight away. ## Check a user's two-factor authentication 1. Go to **Users** and edit the user. 2. Open the **Two-factor authentication** tab. You see which methods the person has set up. You can't set up or remove methods for them: a second factor only protects the account if the person is the only one holding it. They manage their own methods from their **Profile**. ## Help a user who's locked out If someone can't use any of their methods, for example because they lost their phone, you can reset their 2FA from the same **Two-factor authentication** tab. * Resetting clears the person's methods and trusted devices. They set up a new method at their next sign-in. * Before you can reset, CloudTalk asks you to confirm it's you with your own second step. * The person gets an email that an admin reset their 2FA. * You can reset the 2FA of any user in your company, including other admins, but not your own. Manage your own methods from your Profile. From the same tab, you can also click **Revoke all trusted devices**, so the person is asked for their second step again on every device. You can't turn off someone else's two-factor authentication. Only the person can, from their own Profile, and only if your company doesn't require it. ### If no admin can help If every admin is locked out, CloudTalk Support can reset 2FA. For your security: * the request must come from an account admin, never from the user alone, * Support verifies the request against your billing details, never by email, * all active admins in your account get an email about the reset. The one exception: if the reset affected only one person and that person is an admin, they only get their own "CloudTalk support reset your two-factor authentication" email. ## Check the Activity log At the bottom of **Settings > Two-Factor Authentication**, the **Activity log** shows recent two-factor events in your company, such as methods added or removed, resets, and 2FA turned on or off. * Columns: **Date**, **Person**, **Event**, and **Done by**. * It shows the latest 100 events, newest first, 10 per page. * Only admins can see it. ## What 2FA doesn't change * **API keys** keep working. Two-factor authentication only applies to people signing in on a CloudTalk sign-in page. * **SSO sign-ins** are handled by your identity provider. See [How to Use SSO](https://help.cloudtalk.io/en/articles/5784952-how-to-use-sso.md). ## Related articles * [Two-Factor Authentication (2FA)](https://help.cloudtalk.io/en/articles/two-factor-authentication.md): how your users set it up * [Troubleshooting: Can't Sign In with Two-Factor Authentication](https://help.cloudtalk.io/en/articles/troubleshooting-two-factor-authentication.md) *** *Need help or have a question?* Just reach out through our [Support portal](https://support.cloudtalk.io/hc/en-us/requests/new?ticket_form_id=26305535257884). We're here for you. ## Related topics - [Two-Factor Authentication (2FA)](https://help.cloudtalk.io/en/articles/two-factor-authentication.md) - [Troubleshooting: Can't Sign In with Two-Factor Authentication](https://help.cloudtalk.io/en/articles/troubleshooting-two-factor-authentication.md) - [Improving Security](https://help.cloudtalk.io/en/articles/2144840-improving-security.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.