> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexagon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security 2FA

> Security allows users to add an extra layer of protection by setting up two factor authentication What is Two Factor Authentication Two factor authent

Security allows users to add an extra layer of protection by setting up two factor authentication

## What is Two Factor Authentication

Two-factor authentication (2FA) is a security process that requires users to provide two distinct forms of identification before gaining access to FlexDeploy. Typically, this involves a combination of something the user knows (like a password) and something the user possesses (like a code provided by an authenticator or sent to their phone) to enhance the overall security and reduce the risk of unauthorized access.

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/s0aZcWvz1eo3cr__/images/cm112/12725923494.png?fit=max\&auto=format\&n=s0aZcWvz1eo3cr__\&q=85\&s=14467b42bd3921dc49de3dd0cdccbb3f)

> [!NOTE]
>
> By default, 2FA is not enabled for a new user. Each user must opt into 2FA by configuring it in the user’s profile.

## Configuring Two Factor Authentication

In order to start using 2FA for a given user perform the following:

![(blue star)](https://flexagon.atlassian.net/wiki/s/-510684821/6452/64e1779b1cc4eed32fd26c0f5af1f87b02d05b81/_/images/icons/emoticons/72/31-20e3.png) Login into FlexDeploy normally and navigate to your **Profile → Security**

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/NkeZh5D-Nf8j_WaD/images/fd111/12590915875.png?fit=max\&auto=format\&n=NkeZh5D-Nf8j_WaD\&q=85\&s=0c4cf7f605f3a08b7dd23d2af027c0cf)

![(blue star)](https://flexagon.atlassian.net/wiki/s/-510684821/6452/64e1779b1cc4eed32fd26c0f5af1f87b02d05b81/_/images/icons/emoticons/72/32-20e3.png) Click the Enable Two Factor Authentication button. A Verify Your Identity dialog opens. Click Resend code if needed, then check your email for a 6-digit verification code and enter it in the six code boxes. Click Save. @Since 11.2.0.0 Identity verification uses a one-time email code (not your FlexDeploy password). Outgoing email (SMTP) must be configured.

![image-20260820-173123.png](https://mintcdn.com/flexagon-llc-ce77a95c/WGIkb7TtTxAvNbdY/images/fd112/12762185747.png?fit=max\&auto=format\&n=WGIkb7TtTxAvNbdY\&q=85\&s=4c166a143b3ea422d55e497267893686)

![(blue star)](https://flexagon.atlassian.net/wiki/s/-510684821/6452/64e1779b1cc4eed32fd26c0f5af1f87b02d05b81/_/images/icons/emoticons/72/33-20e3.png) Setup your external authenticator application by scanning the provided QR code with your phone or device. Alternatively, if scanning is not possible or it does not work, copy the ***shared key*** and manually configure your authenticator using the key,

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/s0aZcWvz1eo3cr__/images/cm112/12725923485.png?fit=max\&auto=format\&n=s0aZcWvz1eo3cr__\&q=85\&s=610c7ac679925360944860d8a886e802)

> [!NOTE]
>
> *When manually configuring* the authenticator make sure of the following:
>
> * The generated code is 6 digits long
>
> * The period is 30 seconds
>
> * HmacSHA1 is used as the hashing algorithm.
>
> These parameters should be the default for most authenticators. All other options are up to you.

![(blue star)](https://flexagon.atlassian.net/wiki/s/-510684821/6452/64e1779b1cc4eed32fd26c0f5af1f87b02d05b81/_/images/icons/emoticons/72/34-20e3.png) Enter the current code from your authenticator and click “Save”. If the code is valid, the popup will close and snack message will say 2FA is successfully configured.

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/NkeZh5D-Nf8j_WaD/images/fd111/12590915866.png?fit=max\&auto=format\&n=NkeZh5D-Nf8j_WaD\&q=85\&s=2d300c63dcc4229246ab3155b635543d)

At this point, your next login with the current user will prompt for 2FA code after successfully providing username and password. Every login will require 2FA code unless Remember Device is checked.

## Disabling Two Factor Authentication

@Since 11.2.0.0 To disable 2FA from **Profile → Security**, click **Disable Two Factor Authentication**. You must verify your identity with a one-time email verification code (the same User Verification flow used when enabling 2FA). After successful verification in the current session, you may not be prompted again for a short period.

## Administrator Disable of User 2FA

@Since 11.2.0.0 Administrators can disable 2FA for another local user from **Administration → Security → Users**. Use the row actions menu and select **Disable Two Factor Authentication** (shown only when the user has 2FA enabled). The administrator must complete email identity verification before the disable succeeds. This is useful when a user loses their authenticator device and cannot complete recovery themselves.

## Remember a Device

2FA Remember Device in Two-Factor Authentication (2FA) allows users to bypass the second authentication factor on trusted devices for 30 days. With this option, users can experience a more seamless login experience on their trusted devices while still maintaining a strong level of security.

![(blue star)](https://flexagon.atlassian.net/wiki/s/-510684821/6452/64e1779b1cc4eed32fd26c0f5af1f87b02d05b81/_/images/icons/emoticons/72/31-20e3.png) In order to remember a 2FA login, enable the checkbox on the 2FA login (when the code is entered).

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/NkeZh5D-Nf8j_WaD/images/fd111/12590915869.png?fit=max\&auto=format\&n=NkeZh5D-Nf8j_WaD\&q=85\&s=8cdd2b42b8e033481dbb8b31df30b539)

![(blue star)](https://flexagon.atlassian.net/wiki/s/-510684821/6452/64e1779b1cc4eed32fd26c0f5af1f87b02d05b81/_/images/icons/emoticons/72/32-20e3.png) Remembered devices will always display on the users profile → security. You may revoke all or some devices if desired. Users should do this should they lose their phone or any registered device.

***

## FAQ

### Help I lost my authenticator device. How can I login?

As long as your FlexDeploy user has a valid email associated, email settings are configured in FlexDeploy to send mail, and you have access to the email, then you can still login.

From the 2FA prompt, click “recovery code” and then click send “new recovery code”. You should receive an email shortly with your 2FA recovery code which you can enter on screen to login. Beware the recovery code will only last a short period of time.

Once you have logged in with the recovery code you should either disable 2FA in your Profile or reconfigure it with a new device. An administrator can also disable your 2FA from the Users screen if needed.

### Does 2FA work with LDAP?

Yes and setup is the same.

### Does 2FA work with SSO?

Short answer is no. FlexDeploy does not handle the login portion when Single Sign On is enabled and, therefore, we cannot provide 2FA. Check with your SSO provider for 2FA or MFA functionality.

> [!NOTE]
>
> When Single Sign On is enabled, the 2FA still works for a local FlexDeploy user. To use local FlexDeploy user, you need to use the direct login URL.

### Can FlexDeploy send the 2FA code to my phone or email instead?

This is on the roadmap and is not currently supported. Note that email one-time codes are used for identity verification when enabling or disabling 2FA (and for some other sensitive actions); they are not a substitute for authenticator-app codes at login.