Multi-Factor Authentication
A second factor beyond your password. Two kinds satisfy it:
- An authenticator app, generating a code
- A passkey, using your device's own biometrics or PIN
Either is enough. Passkeys are the stronger and the faster of the two - there is no code to type and nothing to phish.
Set yours up in your account settings, under Security. See Your First Hour in the Getting Started section.
When It Is Required
Your workspace's requirement is set by NearSync, and can be raised by your own admins but never lowered. It applies either to admins or to everyone.
Admin, for this purpose, means role weight 60 and above - the department-head band and up, because those are the people holding approvals, payroll and personal data.
The Grace Period
When MFA becomes required you get seven days to enrol.
The clock runs per person, from the later of when the policy took effect or when your account was created - so a new joiner gets their own seven days rather than arriving to a locked door.
After that, you cannot sign in until you enrol.
Caution
The failure mode is discovering the grace has expired at the start of a working day. If you have been prompted, do it then — it takes two minutes, and the alternative is waiting for an admin to reset your factors.
Sessions
Signed-in sessions end automatically after a period of inactivity, set per workspace.
Where heightened protection is enabled, the timeout is capped at 15 minutes regardless of the configured value, and an indicator appears in the header so it is visible rather than mysterious.
If You Are Locked Out
Lost your authenticator. An admin can reset your factors, and you enrol again at the next sign-in.
Forgotten password. Reset it from the sign-in screen.
Grace expired without enrolling. Same as losing your authenticator - an admin resets, you enrol.
Resetting factors lowers that account's protection until enrolment, so it is deliberately an admin action rather than self-serve.
For Admins
The enrolment roster shows everyone, whether they are required, whether they have enrolled, what kind of factor they hold and when their grace ends. It has two actions: ask someone to enrol, and reset factors.
Check it before the grace period ends, not after. See Security and the Audit Log in the Settings section.
Common Questions
Can I use SMS? An authenticator app or a passkey. SMS is the weakest common second factor and is not the path here.
Do I need MFA on every device? The factor is yours, not the device's. A passkey is tied to a device, so register more than one if you switch.
Why am I signed out so quickly? Heightened protection caps the session at 15 minutes. The header indicator tells you it is active.
Can we turn MFA off? You can only raise the requirement, never lower it below the baseline set for your workspace.
Did this answer your question?
No, ask a person