Two-factor authentication (also known as 2FA) is a subset of multi-factor authentication. It allows your users to enable additional protection for their Files.com account by requiring a combination of two different factors to gain access to their Files.com account. Something they know (e.g. their password), and something they have (usually their smartphone, or hardware 2FA key management device).

2FA is an excellent way to improve your security profile and provide an added layer of protection to your data.

Limiting Allowed 2FA Methods

Site administrators may select which 2FA methods are available to their users. All methods are allowed by default, but if your security model doesn't allow SMS, for example, you can deactivate that method.

2FA and Single Sign-on

If Single Sign-On (SSO) is enabled as the authentication method for your users, you can still enable 2FA in the Files.com account, as 2FA configuration with Files.com is independent of your SSO provider. You also have the option to enforce or override the site-wide 2FA requirements using SCIM provisioning.

Mandating 2FA

Administrators with a Power or Premier plan have the option to mandate 2FA for their users. The mandate can be applied for all users, or can be limited to administrators only.

Users flagged as a Shared/Bot user are exempt from 2FA mandates.

Before an administrator turns on this setting, they need to have at least one 2FA method set up for their own user. This is a precaution to prevent the administrator from being locked out of the site. Refer to the Setting up 2FA section below for instructions on how to set up a 2FA method.

You can select whether to make 2FA required for All users, or Site Admins only. Once set, the applicable users will be required to set up and verify a 2FA method upon their next login before they are able to proceed using their account.

Removing the 2FA mandate, once it has been enabled, carries a 7 day waiting period as a security measure. After an administrator removes the 2FA requirement, users will not be able to remove their last 2FA method, and new users will still have to enable at least one 2FA method, until seven days have elapsed.

Exempting Individual Users From Mandate

Site administrators can configure individual user accounts to exempt them from the site-side two-factor authentication requirements.