Enforcing two-step authentication for all users with Organization Settings

FromUsers>Securityin Organization Settings, you can require all users in your organization to usetwo-step authenticationto log in to your stores.

Considerations for enforcing two-step authentication

Enforcing two-step authentication for all users in your organization requires theUsersorganization-level permission.

Two-step authentication can't be enforced for certain users. You can still set two-step authentication to be required for all users, but it won't be enforced for the followinguser types:

• legacy staff
• POS app only
• collaborator
• users that are required to useSecurity Assertion Markup Language (SAML) authentication
• users logging in to Shopify POS
• users logging in to versions of the mobile Shopify app older than version 8.72.0

After you enforce two-step authentication for all users in Organization Settings, two-step authentication can't be managed for individual users. Changing your two-step enforcement setting to individual user management afterwards doesn't revert their login requirements, but does allow users to be managed individually if you want to remove the two-step authentication requirement.

For example, suppose that a user in your organization, Phillipa, isn't required to use two-step authentication. You then activate enforced two-step authentication for your organization. All your users, including Phillipa, are now required to use two-step authentication to log in. Later, you change your enforcement setting back to managing specific users. Phillipa's user accounts are still set to require two-step authentication for all stores in your organization. If you want to remove the two-step authentication requirement, then you can do so through her user page.

Because two-step authentication can be required through an identity provider, users that are required to use SAML authentication aren't affected by this setting. If the SAML requirement is removed from these users and you require two-step authentication in your organization, then they will be required to use two-step authentication after the change is made.

For example, suppose that you activate enforced two-step authentication for your organization. You have a user, Emmy, who is required to use SAML authentication to log in. Later, you remove Emmy's SAML requirement. She is automatically required to use two-step authentication to log in from that point on.

Enforce two-step authentication

Steps:

1. From your Shopify admin, clickSettings.
2. In theOrganizationsection, clickUsers>Security.
3. In theTwo-step authenticationsection, clickChange setting.
4. SelectRequired for all users.
5. ClickSave.

Enforcing two-step authentication takes some time, depending on how many users are in your organization. A banner displays on theSecuritypage indicating that your changes are in progress, and you'll receive an email when the process is complete. The email will also note whether there were any errors during enforcement, and list all users that aren't fully enforced.

Manage errors

When you activate two-step authentication enforcement, every user account in all your stores is set to require two-step authentication. As a result, it's possible for the process to complete for some users but not for others, and for some users to have different login requirements in different stores.

For example, suppose that in your organization you have three stores. You activate enforced two-step authentication, and after the process is complete, you receive an email stating that your two-step authentication changes didn't complete for one of your users, Daveed. In this state, every user in your organization except Daveed needs to use two-step authentication to log in. This means that although Daveed might need to use two-step authentication for some of your stores, there are other stores where he can log in without authenticating.

If you receive an error after activating two-step authentication enforcement, then try activating enforcement again.

Steps:

1. From your Shopify admin, clickSettings.
2. In theOrganizationsection, clickUsers>Security.
3. In theTwo-step authenticationsection, clickTry again.

If enforcing two-step authentication for one of your users fails repeatedly, then contact Shopify Plus Support.

Deactivate two-step authentication enforcement

1. From your Shopify admin, clickSettings.
2. In theOrganizationsection, clickUsers>Security.
3. In theTwo-step authenticationsection, clickChange setting.
4. SelectSpecific users.
5. ClickSave.