Multi-factor authentication is no longer a nice-to-have. A password, however strong, is a single thing that can be phished, reused, or leaked — and a second factor is the most effective, lowest-effort defence against exactly that. The hard question was never whether to add MFA, but how, without making everyone's daily sign-in miserable.
Most systems force an all-or-nothing choice: turn MFA on for the whole organization, or for nobody. The platform now takes a more precise approach — multi-factor authentication that you enforce by role, so the strongest protection lands exactly where it matters and the friction stays where it is justified.
The all-or-nothing problem
Switch MFA on for everyone and you protect the sensitive accounts — at the cost of a second step for every casual user, every read-only viewer, every occasional contributor, every day. Switch it on for no one and your most dangerous accounts share the same thin defence as the least dangerous. Neither is right. The finance team, the administrators, and the people who can change configuration genuinely need a second factor. A part-time viewer arguably does not. A good policy treats those cases differently.
MFA that follows the role
You already describe who can do what through roles. Multi-factor enforcement now plugs straight into that model: any role can be configured to require a second factor at sign-in. Assign that role to someone and they inherit the requirement automatically — there is no per-user toggling to maintain, and no chance of forgetting to protect a new hire who joins a sensitive team.
People often hold more than one role, so the rule is simple and safe: the strongest requirement among all of a user's roles is the one that applies. Security composes upward. Grant someone a privileged role and their sign-in is hardened the moment they receive it, regardless of whatever else they are.
Two ways to prove it's you
Different organizations — and different roles — want different levels of assurance, so there are two methods. The first is a one-time numeric code sent to the user's email: simple, requires nothing extra, and a clear step up from a password alone. The second is a time-based code from an authenticator app — Google Authenticator, Authy, 1Password, or any standard equivalent — for stronger, device-bound protection. You choose which method a role requires; the platform handles the rest.
Set up once, automatically
For the authenticator-app method, enrollment happens on first use without an administrator in the loop. The user is guided through a quick setup — scan a QR code with their app, with a manual option for anyone who needs it — and from then on their app produces the codes. There is no separate onboarding project and no help-desk ticket to get a user protected. The first time they need it, they set it up, and it is done.
No quiet bypasses
A second factor is only as good as the gaps around it, so the obvious ones are closed. The factor is checked on every sign-in — there is no "trust this device and stop asking," which is precisely the convenience that undermines MFA in practice. And critically, an account whose role requires MFA cannot sidestep it through a static API key or a single-step magic link. The strength of "this role needs two factors" holds across every way in, not just the login form. The protection means what it says.
Why it matters
Security that you cannot target is security you end up under-applying, because the cost of applying it everywhere is too high. By binding multi-factor authentication to roles, the platform lets you raise the bar exactly where the risk lives — privileged, financial, administrative accounts — while leaving low-risk users unburdened. It scales the way your organization already does, through the role model you have already built, and it closes the side doors that so often make MFA theatre rather than protection.
It sits naturally alongside the rest of the platform's governance: roles and permissions decide what a user can do, secrets management keeps credentials out of reach, and now multi-factor enforcement strengthens the front door itself — proportionate, automatic, and exactly where it counts.