Require two-factor or Google sign-in for a workspace

A workspace admin can require every member of the workspace to sign in a certain way. There are two requirements, and you can turn on either or both:

• Require two-factor authentication. Every member must have two-step verification turned on and use it when they sign in.
• Require sign in with Google. Every member must sign in with Google. Signing in with a password, an email code, GitHub or a passkey does not count, and Google’s own two-step verification does not count as ours.

The rules apply to everyone in the workspace, including the workspace owner.

Who can turn a requirement on

• You need the Admin role in the workspace. Other members can see whether a requirement is on, but cannot change it.
• The workspace must be on a plan that includes team members. On a plan without team members, the Security page shows an upgrade prompt instead of the control.
• You must already meet the requirement yourself. To require two-factor authentication, turn it on for your own account first. To require Google sign-in, sign in with Google first.
• You are asked to confirm it is you before the change is saved.

Turn a requirement on or off

1. Open Settings > Security in the workspace.
2. Next to the requirement, select Enforce, read what will happen, and select Confirm enforce.
3. To remove a requirement, select Turn off. This works on every plan, including after a downgrade.

A requirement that was on before a plan downgrade stays on until an admin turns it off.

What a member who does not comply sees

A member who does not meet a requirement sees a message in place of the workspace’s pages. From there they can:

• set up two-factor authentication in Account settings (the page unblocks as soon as it is on, with no need to sign in again),
• sign out and sign back in with Continue with Google (connect Google in Account settings first if it is not connected yet),
• switch to another workspace,
• leave the workspace, or
• sign out.

Their other workspaces are not affected.

API tokens and SSH

AI client tokens and SSH keys do not carry a sign-in method, so for them the requirement is checked against the account of the person who created them:

• two-factor authentication: that person must have it turned on for their account;
• Google sign-in: that person must have Google connected to their account.

If not, requests made with the token, and SSH connections made with the key, are refused for this workspace until the person meets the requirement or an admin turns it off.

If no one can meet a requirement

If a sign-in method stops being offered on Voroa while your workspace requires it, a workspace admin can still turn that requirement off from the message they see, after confirming it is them. If you are locked out, contact support.