Require two-factor sign-in

Hyperion can require two-factor sign-in for every account on the Administrator or Owner role. The rule is on by default. When it is on, one of these accounts that has no two-factor enrollment is sent to My profile at sign-in and cannot open anything else until it enrolls.

Before you start

• Sign in as an Owner. A role that can open Settings but is not Owner sees the setting with every form disabled.
• Tell your Administrators and Owners what to expect and point them to Set up two-factor sign-in.
• Keep one Owner enrolled and tested before you turn the rule on, so you can still reach the panel if another account has trouble.

Steps

1. Open Settings in the sidebar, under Administration.
2. In the sub-navigation, under Security, open Access.
3. In the Sign-in group, find the Two-factor sign-in card. Its badge reads required or optional.
4. Tick Require 2FA for Administrator and Owner accounts to turn the rule on, or clear it to turn it off.
5. Click Save. The page shows “Two-factor sign-in saved — the agent restarts in about 5 s.”

Before you turn the rule off

With the rule off, Administrators and Owners can sign in with a password alone. Turn it off only briefly, for example during a server move. The card itself says so.

Nobody is signed out when you change the rule. The panel picks the change up within about 30 seconds, and it is checked at the next sign-in. To undo, tick the box again and click Save.

What the rule does

• Applies to: the built-in Administrator and Owner roles. Operators, Customers, Read-only users and users on custom roles are never asked for two-factor by this rule. They can still enroll voluntarily.
• At sign-in: after the password, an account without enrollment is sent to My profile. The page shows “Two-factor authentication is required for your role.” and the enrollment steps. Every other page redirects back to My profile until the person finishes. Signing out still works.
• After enrollment: the same session is upgraded, so the person does not sign in again.
• Accounts that are already enrolled: unchanged. They enter a code at every sign-in, or skip it on a browser they trusted for 30 days.

Check that it worked

• The Two-factor sign-in card badge reads required.
• Open Users. The 2FA column shows enrolled or 2FA off for each person. Accounts that show 2FA off and have the Administrator or Owner role are gated at their next sign-in.
• Sign in with an Administrator account that has no enrollment, in a separate browser. You land on My profile with the “Two-factor authentication is required for your role.” banner.

If it fails

• The checkbox and Save are greyed out: you are not an Owner. The page shows “You can see these settings; only an Owner can change them.” Saving anyway returns “Only an Owner can change settings.”
• “The agent’s settings could not be read (…). These are defaults, not what is set, so saving is off until it answers.”: the agent did not answer. Wait for it to restart and reload the page.
• A person lost their authenticator: follow Regain access to the panel. With the rule on, they enroll again at their next sign-in.
• The rule does not apply to a person: it covers only the built-in roles. A custom role is not asked for two-factor, whatever capabilities it holds.