Administering two-factor authentication

If you're assigned the superuser role for your company, you can control two-factor authentication (2FA) settings for your account both company-wide and for individual users. The User management page displays a list of all users associated with your company, including their currently assigned roles, the security posture of their 2FA and SSO, and when they were last active online.

Enabling company-wide two-factor authentication

To enable company-wide two-factor authentication for all users:

1. Log in to the Fastly control panel and select Account from the navigation sidebar.
2. In the Company options area, click the Company-wide two-factor authentication switch to ON.

Two-factor authentication becomes required for all users in your company. Anyone currently logged in and not previously using 2FA on their account will be logged out of the Fastly control panel. Anyone who has not already enabled two-factor authentication for their account will be prompted to do so the next time they log in to the Fastly control panel.

Disabling company-wide two-factor authentication

Once this feature is disabled, existing users will be able to manage their own two-factor authentication settings, and new users will not be required to set up two-factor authentication.

To disable company-wide two-factor authentication:

1. Log in to the Fastly control panel and select Account from the navigation sidebar.
2. In the Company options area, click the Company-wide two-factor authentication switch to OFF. Company-wide two-factor authentication becomes disabled.

Resetting a user's two-factor authentication

If company-wide two-factor authentication is enabled, superusers can reset any user's two-factor authentication. This may be necessary if a user gets locked out of their account, loses access to their authentication device, or needs to switch to a new device. Resetting 2FA clears the user's current authentication setup and requires them to configure it again on their next login.

To reset a user's two-factor authentication:

1. Log in to the Fastly control panel.
2. Go to Account > User management.
3. In the Active users area, click the three dots to the right of a user name and then select Reset 2FA. A warning message appears.
4. Click Reset. The user will need to set up two-factor authentication for their account the next time they log in.

Disabling two-factor authentication for a single user

If company-wide two-factor authentication is disabled, superusers can disable two-factor authentication for individual users who have voluntarily enabled it on their own accounts. This may be necessary if a user has lost access to their authentication device or if an account needs to be repurposed.

To disable two-factor authentication for a single user:

1. Log in to the Fastly control panel.
2. Go to Account > User management.
3. In the Active users area, click the three dots to the right of a user name and then select Disable 2FA. A warning message appears.
4. Click Disable. Two-factor authentication will no longer be required for the selected user.

Ignoring two-factor authentication for a single user's account

If company-wide two-factor authentication is enabled, a superuser can exempt individual users from the company-wide 2FA requirement by ignoring two-factor authentication for their accounts. This is typically done for accounts being used for scripts and session authentication.

To ignore two-factor authentication for a single user's account:

1. Log in to the Fastly control panel.
2. Go to Account > User management.
3. In the Active users area, click the three dots to the right of a user name and then select Ignore 2FA. A warning message appears.
4. Click Ignore. Two-factor authentication will no longer be required for the selected user.

Related content

• Managing your two-factor authentication
• User API documentation