> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Configure Two-Factor Authentication

> Enforce two-factor authentication for your enterprise, and set up TOTP-based 2FA on an individual user account.

Two-factor authentication (2FA) adds a second verification step to the sign-in process. Edge Infrastructure Services supports time-based one-time passwords (TOTP) generated by authenticator apps such as Google Authenticator or Authy.

## Introduction

2FA in Edge Infrastructure Services operates at two levels:

* **Enterprise-wide enforcement**: An administrator requires all users in the enterprise to set up 2FA before they can access the console.
* **Per-user self-service**: An individual user enables 2FA on their own account.

This procedure covers both levels.

## Prerequisites

* To enforce 2FA enterprise-wide: You have the SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* To set up 2FA on your own account: You are signed in to Edge Infrastructure Services.
* A TOTP authenticator app is installed on your mobile device (for example, Google Authenticator or Authy).

## Enforce 2FA Across the Enterprise

When enforcement is enabled, all users in the enterprise are required to set up 2FA. Users who have not yet configured 2FA are prompted to do so on their next sign-in. Newly invited users see the TOTP enrollment screen on their first sign-in, before they reach the dashboard.

1. In the header, select your profile avatar, then select **Enterprise**.
2. In the Enterprise Settings navigation, under **Security & Access**, select **Authentication**.
3. In the **Two-Factor Authentication** card, toggle **Enforce For Current Enterprise** on.

The change takes effect immediately. If a parent enterprise already enforces 2FA, the toggle is locked and reads as inherited.

To disable enforcement, toggle the setting off. Individual users who have already set up 2FA will retain their configuration and can continue using it.

## Enforce 2FA for Child Enterprises

If your enterprise has child enterprises, a second toggle, **Enforce For Child Enterprise**, appears in the **Two-Factor Authentication** card. Enabling this toggle requires all users in every child enterprise to set up 2FA.

1. In the header, select your profile avatar, then select **Enterprise**.
2. In the Enterprise Settings navigation, under **Security & Access**, select **Authentication**.
3. In the **Two-Factor Authentication** card, toggle **Enforce For Child Enterprise** on.

This setting is available only when the enterprise has at least one child enterprise. Child enterprises that already have their own enforcement enabled are unaffected by this toggle.

## Set Up 2FA on Your User Account

Individual users can enable 2FA through their profile settings, regardless of whether enterprise-wide enforcement is active.

1. In the header, select your profile avatar, then select **Profile Settings**.
2. In the Profile Settings navigation, under **Security & Access**, select **Security**.
3. In the **Authentication** section, toggle **Enable 2FA** on.
4. The **Set Up Two-Factor Authentication** dialog opens. Scan the QR code with your authenticator app. If you cannot scan the code, select the **Copy** button next to the secret key and enter it manually in your authenticator app. The account label in your authenticator app shows your username, not your email address.
5. Your authenticator app generates a 6-digit code that refreshes every 30 seconds. In the **Verification Code** field, enter the current code.
6. Select **Verify and Enable**. The button is enabled only after you enter a 6-digit code.

The Security section now shows a green **Enabled** badge next to Two-Factor Authentication.

## Disable 2FA on Your User Account

You can disable 2FA on your own account even when enterprise-wide enforcement is active.

1. In the header, select your profile avatar, then select **Profile Settings**.
2. In the Profile Settings navigation, under **Security & Access**, select **Security**.
3. Select **Disable 2FA**.
4. In the dialog, enter your current TOTP verification code.
5. Select **Disable 2FA** to confirm.

> [!NOTE]
>
> If enterprise-wide enforcement is active, the console signs you out as soon as you confirm. At your next sign-in, you must set up TOTP again on the enrollment screen before you can access the console.

## Verify the Configuration

After enabling 2FA on your account, sign out and sign back in. After entering your username and password, the console prompts you for a verification code. Enter the 6-digit code from your authenticator app to complete sign-in.

## Next Steps

> [card] [Enable Single Sign-On](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enable-sso.md)
>
> Authenticate users through an external identity provider. 2FA enforcement applies to SSO users as well.

> [card] [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md)
>
> View which users have completed 2FA setup.

> [card] [Enterprise Settings Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enterprise-settings.md)
>
> The full list of enterprise security options.