Two Factor Settings

About this block

Two Factor Settings is the 2FA methods panel, three ruled rows covering authenticator app (Added Jan 14, 2026 with a Manage action), SMS backup (the number partially redacted with an honest note that SMS codes are weaker and should not be your primary method), and backup codes showing 6 of 10 remaining with a Regenerate action. Below the ruled list a workspace requirement section carries the Require 2FA for all team members toggle with the consequence: members without 2FA will be blocked at next sign-in.

Methods are one const array with a consistent shape so every row has the same keys. The honesty note on SMS is the key detail; without it users pick SMS as their primary method and are surprised when it fails.

When to use

Reach for this block on the security or account settings page, wired to your 2FA status endpoint and the workspace policy flag in your org settings. Gate the workspace requirement section to admin roles.

A natural flow around it on an Application Pro page:

Before

• Settings shell

After

• Session timeout settings
• Activity feed

What you can display

One strong use is the personal 2FA configuration panel. Other variants:

• Hardware keys. Add a passkey or FIDO2 key row above the authenticator row.
• Recovery email. A fourth row for the recovery address used when all methods are lost.
• Enforce by role. Show the workspace toggle only on the admin settings page, hidden for members.

Tip: name the SMS weakness explicitly in the row note so users self-select toward the authenticator app without a support conversation later.