> ## Documentation Index
> Fetch the complete documentation index at: https://ahasend.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> AhaSend stores all message data in the EU. See /facts.
> The API base URL is https://api.ahasend.com. Send the API key in the Authorization: Bearer header. See /api-reference/authentication.
> Use send.ahasend.com for SMTP. Ports 25, 587 and 2525 use STARTTLS. Port 465 is not supported. See /smtp.
> For send-only integrations, create an API Key v2 under Credentials → Add and scope it to messages:send:{your-domain}. See /send-api/credentials and /api-reference/scopes.

# Require 2FA for All Team Members

> As the AhaSend account owner, require every team member to set up two-factor authentication before they can open the dashboard, and see what they experience.

As an AhaSend account owner, you can require two-factor authentication for every team member; this guide explains how to enable enforcement.

Available on Free, Pro and Max. See [plans and features](https://ahasend.com/docs/facts.md#plans-and-features).

> [!NOTE]
>
> **Account Owner Only:** Only the account owner can enable 2FA enforcement. This setting affects all team members and requires careful planning.

## What is 2FA Enforcement?

2FA enforcement is an account-level security setting that mandates all team members use two-factor authentication. Think of it as adding a second lock to a shared door - everyone needs both the key (password) and the code (2FA) to enter.

**Key Behavior:**

* **Immediate requirement:** Team members without 2FA are prompted to set it up upon next access
* **Access blocked:** No account features available until 2FA is configured
* **Per-account setting:** Enforcement applies only to the specific account where it's enabled

## Prerequisites

Before enabling 2FA enforcement, the account owner must:

**1. Enable Personal 2FA**

**Set up 2FA on your own profile first:**

Follow the complete [2FA setup guide](https://ahasend.com/docs/security/2fa.md) to enable Two-Factor Authentication on your personal account, including saving recovery codes.

> [!WARNING]
>
> **Required First Step:** You cannot enforce 2FA for others without having it enabled on your own profile.

## Enabling 2FA Enforcement

Once your personal 2FA is active, enable enforcement for your team:

**1. Access Account Settings**

**Navigate to account-level security settings:**

1. **Log in** to your AhaSend dashboard as the account owner
2. **Go to** **[Account Settings](https://dash.ahasend.com/account/-/settings)**
3. Scroll to the **Security** section

**2. Enable Enforcement**

**Activate the enforcement setting:**

1. **Find** "Enforce Two-Factor Authentication" option
2. **Toggle** or check the box to enable
3. **Save** changes to activate immediately

> [!NOTE]
>
> **Immediate Effect:** Enforcement takes effect immediately for all team members.

Enforcement includes the account owner. When OIDC SSO is enabled for the account, enforce MFA at your identity provider; AhaSend skips its own profile-2FA gate for that SSO account. See [SSO configuration](https://ahasend.com/docs/security/sso.md).

## What Happens to Team Members

When 2FA enforcement is enabled, team members experience the following:

### First Access After Enforcement

* **2FA Already Enabled:** Normal access to account dashboard
* **2FA Not Enabled:** Redirected to profile settings with setup requirement

### Setup Process

1. **Clear messaging** explains 2FA is now required for account access
2. **Guided setup** walks through 2FA configuration
3. **Access blocked** until 2FA setup is completed successfully

> [!TIP]
>
> **Team Communication:** Notify your team before enabling enforcement to avoid access disruptions during critical operations.

## Multiple Account Scenarios

It's common for users, especially agencies or consultants, to be members of multiple AhaSend accounts. **The 2FA enforcement setting is specific to each individual account.**

This means that enabling 2FA enforcement on one account does not automatically force a user to enable 2FA to access other accounts they are members of, unless those other accounts also have 2FA enforcement enabled.

## Why Enforce 2FA?

Mandatory 2FA provides critical security benefits for team accounts:

> [accordion] Prevent Unauthorized Access
>
> **Protection against compromised passwords:**
>
> * Stolen credentials alone cannot access your account
> * Requires physical device access for the second factor
> * Significantly reduces breach risk from password attacks

> [accordion] Protect Critical Infrastructure
>
> **Safeguard your email operations:**
>
> * Prevents unauthorized changes to sending configurations
> * Protects sensitive recipient data and email content
> * Maintains your domain's sending reputation

> [accordion] Compliance Requirements
>
> **Meet security standards:**
>
> * Helps enforce your team's account-access policy
> * Demonstrates security best practices to auditors
> * Reduces liability from security incidents

## Best Practices

> [accordion] Implementation Planning
>
> **Smooth enforcement rollout:**
>
> * **Advance notice:** Inform team members before enabling
> * **Support availability:** Be ready to help with setup issues
> * **Timing consideration:** Avoid enabling during critical campaigns

> [accordion] Team Communication
>
> **Keep your team informed:**
>
> * Explain the security benefits of 2FA enforcement
> * Provide links to 2FA setup documentation
> * Share best practices for recovery code storage

## Related Guides

* [Account quickstart](https://ahasend.com/docs/quickstart.md), [Set up 2FA first](https://ahasend.com/docs/security/2fa.md), [Team members API](https://ahasend.com/docs/api-reference/accounts/get-account-members.md).
* [Plans and limits](https://ahasend.com/docs/facts.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.