In one sentence
Multi-factor authentication (MFA) means a signed-in session has to prove two distinct factors — so a stolen password alone, or an SSO login alone, isn't enough to reach your organization's data.
- Two distinct factors, always. The factor types are password, passkey, authenticator app (TOTP), and SSO. A session needs two different ones — the same factor twice doesn't count.
- SSO doesn't satisfy MFA on its own. Signing in with Google or Microsoft counts as one factor; you still add a second (a passkey, or an authenticator code).
- Set up your second factor in your Profile. The authenticator app and passkeys both live under Profile → Security.
Which factor combinations work
A valid session pairs two different factors. Common combinations:
| Primary factor (how you logged in) | Second factor |
|---|---|
| Password | Authenticator app (TOTP) |
| Password | Passkey |
| Passkey (passwordless) | Authenticator app (TOTP) |
| Passkey (passwordless) | SSO |
Because SSO is a single factor, an SSO sign-in still routes you to add a second factor before you reach the dashboard. And a passwordless passkey login can't use another passkey as its second factor — it needs a distinct type, such as an authenticator app.
Setting up an authenticator app (TOTP)
An authenticator app generates a rolling 6-digit code that serves as your second factor. It works with Google Authenticator, 1Password, Authy, or any RFC 6238 TOTP app.
- Open your Profile and find the Security · Authenticator app card.
- Click Set up authenticator app.
- In your authenticator app, choose "enter a setup key" and paste the setup key shown — or, on the same device, open the
otpauth://link. Your account is your email; the issuer is QFormance. - Enter the current 6-digit code the app shows and click Verify & enable.
- Save your recovery codes. A panel of one-time codes appears — this is the only time they're shown. Copy them somewhere safe.
The one-time recovery codes are displayed a single time at setup. If you don't save them, you can mint a fresh set later with Regenerate recovery codes on the same card — but regenerating invalidates the previous set.
Once enabled, the card shows how many unused recovery codes remain, plus buttons to Regenerate recovery codes or Remove the authenticator.
Using a passkey or security key as a factor
A passkey can be either your primary login or your second factor. Passkeys work with platform authenticators (Touch ID, Face ID, Windows Hello) and with roaming security keys — YubiKey, Titan, or any FIDO2 key.
- Set up passkeys under Profile → Security · Passkeys (see Passkeys for the full walk-through).
- A hardware security key must have a PIN set — QFormance requires user verification, so a key without a PIN won't enroll.
- If you logged in with a passkey (passwordless), that passkey is your primary factor; your second factor is then an authenticator app or SSO, not the same passkey again.
The sign-in challenge
When you sign in and your session doesn't yet have two distinct factors, QFormance routes you to a second-factor challenge before the dashboard loads:
- Enter your authenticator code — the current 6-digit code from your app.
- Use a recovery code — click Use a recovery code instead and enter one of your saved one-time codes.
- Verify with passkey or security key — complete a passkey/security-key check instead of typing a code.
Trust this device for 30 days
The challenge offers a Trust this device for 30 days checkbox. Tick it and, for the next 30 days on that browser, sign-ins on the device skip the second-factor prompt (you still enter your primary factor). Leave it unchecked on shared or public machines.
If you have no second factor yet
New members — and anyone stranded by a policy change — are sent to a Set up multi-factor authentication page instead of the challenge. Enroll an authenticator app (or a passkey, if that's available for your account) there, then continue to the dashboard.
Recovery if you lose a factor
You manage your own factors from Profile → Security — but only while you can still sign in. So the escape hatch when your authenticator is gone is a recovery code, not the Profile page.
| Situation | What to do |
|---|---|
| Lost your phone / authenticator app, but still have recovery codes | Enter a recovery code at the sign-in challenge to get in — then set the authenticator up again from your Profile. |
| Running low on codes (while you can still sign in) | Regenerate a fresh set from Profile → Security · Authenticator app before you run out. |
| Locked out — lost your authenticator and your recovery codes | You can’t self-recover. Ask an org admin: from Admin → Users they reset your password, after which you re-enroll a second factor at your next sign-in. |
Recovery codes each work once. Save them somewhere safe the moment you enroll, keep a couple in reserve, and regenerate before you run out — they’re what gets you back in when nothing else can.
For admins
MFA is enforced org-wide. Which sign-in methods your members may use, and which email domains are accepted, are set at Admin → Organization → Auth & Sign-in Policy — and the save flow now warns you before a change would lock other members out. See Auth & sign-in policy.