Two-factor authentication (2FA) asks for a code from an authenticator app at sign-in, on top of the password. Administrators can require it for everyone or for chosen roles, on the Professional, Enterprise and Signature plans.
SmartSuite uses time-based one-time passwords (TOTP). Google Authenticator, Microsoft Authenticator, Duo Mobile and Twilio Authy all work.
Example: a compliance team on Professional turns on 2FA for every member before its SOC 2 audit. When a control owner loses her phone, the Administrator resets her enrollment and she sets up the app again.
Plan Availability | Professional, Enterprise, Signature. |
Permissions | Administrators require, change and reset 2FA for members. Every member sets up their own app. |
Platform | Web |
Related Reading |
Supported apps
SmartSuite supports TOTP codes from these apps:
Google Authenticator
Microsoft Authenticator
Duo Mobile
Twilio Authy
Requiring 2FA
Once required, every member in scope must set up and use 2FA to sign in.
Open Workspace Administration, then select Access under Security.
In the Two-Factor Authentication (2FA) row, select Edit.
Turn on Enable Two-Factor Authentication, then select Save. SmartSuite records the Administrator's name and the date.
The Two-Factor Authentication (2FA) window under Security > Access, with the Enable Two-Factor Authentication toggle and the Enable for list of roles.
Choosing which roles need 2FA
By default, every member must use 2FA once it is required. To require it for some roles only:
In Security > Access, select Edit in the Two-Factor Authentication (2FA) row.
Under Enable for, check the roles that must use 2FA, or select Everyone.
Select Save.
Note: Removing the 2FA requirement for a role does not remove 2FA a member already set up. It only removes the requirement. To let that member sign in without 2FA, reset their enrollment.
Turning the requirement off
In Security > Access, select Edit in the Two-Factor Authentication (2FA) row.
Turn off Enable Two-Factor Authentication, then select Save.
Members who set up 2FA keep it until their enrollment is reset.
Resetting a member's 2FA
If a member loses their 2FA device, an Administrator resets the enrollment. The member then sets up 2FA again at their next sign-in, if their role requires it.
In Workspace Administration, select Manage Members, then the three-dot menu on the right of the member's card.
Select Reset Two-Factor Enrollment.
Select Confirm to delete the member's current 2FA settings, or Cancel to keep them.
Setting up 2FA as a member
You set up 2FA when you sign in after an Administrator requires it, or from Manage Two-Factor Authentication in your profile.
Open your authenticator app and add a new account.
Scan the code SmartSuite shows, or enter the key.
Enter the code from the app to finish.
Tip: Set up the app on a second device, or save its backup, before you need it. A lost phone otherwise means waiting for an Administrator.
Frequently asked questions
Which plans include two-factor authentication?
Which plans include two-factor authentication?
Two-factor authentication is on the Professional, Enterprise and Signature plans. Team does not include it.
Which authenticator apps work with SmartSuite?
Which authenticator apps work with SmartSuite?
Google Authenticator, Microsoft Authenticator, Duo Mobile and Twilio Authy, or any app that gives TOTP codes.
I lost my phone. How do I sign in?
I lost my phone. How do I sign in?
Ask an Administrator of your workspace to reset your 2FA enrollment. Then set up 2FA again at your next sign-in.
Does turning off the requirement remove 2FA from members?
Does turning off the requirement remove 2FA from members?
No. It removes the requirement only. Members who set up 2FA keep it until an Administrator resets their enrollment.
Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.
Last verified 1 Nov 2026.