Settings/Authentication/MFA
Multi-factor authentication
Authenticator apps, email/SMS OTP, security keys, passkeys, and one-time recovery codes.
Setup
Recovery codes are shown once and stored hashed.
Organization enforcement
Configured under Auth policy — all users, admins, security-sensitive roles, or selected workspaces.
Open Auth policy to require MFA for administrators or entire organizations.