Troubleshooting 2FA

Two-Factor Authentication (2FA) can be a crucial part of your organization's security requirements, and not being able to connect due to problems with your configuration can be frustrating. Here are things to look for when user accounts using 2FA are not able to connect.

This page covers failures that can occur after 2FA has been configured and is in use - situations where a user follows the correct steps and still cannot authenticate.

Problems Using SMS Authentication

SMS authentication messages are sent almost immediately after a web sign-in attempt. If no message arrives within a few minutes, try signing in again. Restarting the device sometimes resolves temporary network or connectivity issues.

An unused SMS code is valid for 10 minutes and is consumed when it establishes a sign-in. Repeat FTP, SFTP, or WebDAV connections can continue using the password and code within that sign-in's limits. A separate new sign-in needs a fresh code, which Files.com sends when the user starts a web sign-in.

Confirm the device has a strong signal, reliable network connectivity, and is not in "Do Not Disturb" mode.

Files.com uses Twilio to send SMS messages. Check Twilio's status page to see whether service issues are affecting the recipient's region.

SMS delivery is handled by third-party telecommunications providers. Files.com initiates the message through Twilio and does not control delivery beyond Twilio's network.

Files.com cannot troubleshoot carrier-specific issues such as blocked messages, delivery delays, or filtering applied by mobile carriers that prevents SMS messages from reaching the device. If these issues continue, switch to an authenticator app or another supported two-factor authentication (2FA) method.

Problems With 2FA and FTP/SFTP/WebDAV

An existing FTP, SFTP, or WebDAV user who cannot authenticate after 2FA was enabled has most likely not set up a 2FA method yet. A password login fails with an error like this one:

Two Factor Authentication Required: You must first set up a 2FA method before you may perform any other action.

Enabling the sitewide bypass does not prevent this, because the per-user bypass option is only selectable while the user configures their 2FA method. Users who authenticate with an API key are unaffected, because those logins never involve 2FA.

Before turning on a mandate that reaches protocol users, move them to API keys or exempt them from the mandate.

If an initial connection succeeds but another rejects the same appended code, check whether it uses the same protocol, public source IP address, Files.com server address, and connection settings. Reuse also ends at the expiration assigned to the first sign-in, or earlier if that sign-in is invalidated. A new sign-in needs a fresh code. The repeat-connection rules explain why the same hostname can still lead to different results.

Missing Emails

When a user has configured an Email 2FA Method but is not receiving the emails, several tools help track down the issue. Use the Outbound Emails Log to determine when the email was sent.

Have the recipient check their spam folder to verify that the email titled "Verification Code" was not automatically hidden from their inbox.

Some email apps on smartphones and tablets don’t refresh automatically. You may need to refresh or restart the app to receive new emails.

Confirm that the user account's email address is correct, valid, and free of typos.

If the email was sent but did not arrive, the recipient's mail servers may be blocking or rejecting emails from Files.com. Within an organization's network, intermediate servers such as email gateways, forwarders, mail transfer agents, and security systems can modify email content or headers for tagging or classification during transit.

Those changes to the subject line, headers, or body can break DKIM signature validity or DMARC/SPF validation, which then causes the receiving mail servers to reject Files.com emails. Review the settings of the organization's intermediate servers to resolve email authentication problems.

Rate Limiting

When the wrong 2FA code is provided too many times in a row, further authentication attempts are rate-limited. An error message indicates that too many authentication attempts have been made.

Wait before attempting to reconnect. Resetting the 2FA method does not shorten the waiting period.

Resetting 2FA

Site Administrators can reset a user's enrolled 2FA methods. Workspace Administrators can do so for users within their Workspace.

Group Admins need the site's edit and password-reset capabilities, and the user's Primary Group must be one they administer. Group Admins cannot reset 2FA for accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Group Admin's own site.

Partner Admins can reset methods within their Partner when Allow credential changes is enabled.

A parent-site account with Child Site Administrator access remains subject to these parent-site account-management permissions. That grant does not prevent an eligible Group Admin on the Parent Site from resetting its 2FA.

Reset 2FA when a user's 2FA device is lost or the user needs to configure a new 2FA method.

To trigger a reset through the web interface, edit the user's Two-factor authentication settings and choose Reset this user's 2FA methods. All of the official Files.com SDKs also provide a method for triggering this reset. The reset uses re-authentication to confirm the acting administrator's identity before removing the user's existing methods.

When prompted, the administrator verifies with their own password or active 2FA method. API-key authentication and the documented SSO exceptions satisfy this control without a password or 2FA challenge.

A user whose 2FA has been reset is prompted to create a new 2FA method on the next login through the web portal, if they are required to have a 2FA method.

Waiting Period When Removing 2FA Mandate

After an administrator requests removal of a site-wide mandate, the requirement remains active for 7 days. This gives administrators time to discover the pending removal before it takes effect. Users covered by the mandate cannot remove their last method during this period. See Removing a 2FA Requirement for details.