# Require two-step sign-in for everyone in your workspace

How the owner or an admin makes two-step sign-in or a passkey a must for everyone in a shared workspace, what members who don't have one see, the 7-day grace period, and how to turn the rule off again.

A shared workspace can require everyone in it to sign in with a second step. Each person then needs at least one of these on their own Bluedeer account:

- **Two-step sign-in**, with codes from an authenticator app or emailed codes. See [How do I turn on two-step sign-in?](https://support.bluedeer.ai/bluedeer/account-and-security/turn-on-two-step-sign-in.md)
- **A passkey**, which signs in with a fingerprint, face or device PIN. See [How do I add a passkey and sign in with it?](https://support.bluedeer.ai/bluedeer/account-and-security/sign-in-with-a-passkey.md)

If the workspace uses [single sign-on](https://support.bluedeer.ai/team/administration/single-sign-on.md), signing in to Bluedeer with it counts too, for that sign-in: your company's identity provider takes care of the second step. It counts each time you sign in that way, not for the account. The same person signed in with a password, Google or Apple needs two-step sign-in or a passkey of their own to open the workspace.

Nobody is left out of the rule, the owner included. Personal workspaces don't have it.

## Who can turn it on

Only the workspace owner or an admin can see and change this rule. Members don't see it.

On the web, open the **Workspace** page, select **Settings**, and choose the **Security** tab. **Require two-step sign-in** is at the top, above **Single sign-on**.

You must meet the rule yourself before you can turn it on. If your own account has neither two-step sign-in nor a passkey, Bluedeer asks you to set one up first in **Settings** > **Account**, and offers a button that opens it.

## Turn it on

1. Under **Require two-step sign-in**, select **Turn on**.
2. Bluedeer shows how many people in the workspace don't have two-step sign-in or a passkey yet, and lists them by name, email address and role.
3. Choose when the rule starts for them:
   - **Give them 7 days to set it up (recommended).** This is chosen for you. The window shows the day it starts.
   - **Right away.** The workspace is locked for them straight away.
4. Select **Turn on**.

Afterwards, the setting shows since when the rule is on, the day people who don't meet it are locked out (or since when they have been), and the list of people who still don't meet it. If Bluedeer couldn't check some people's sign-in just then, it says how many, and checks again by itself.

## What members see

People who don't meet the rule get an email when it is turned on. With the 7-day grace period, they get a reminder on the last day.

- **During the 7 days**, everything works as before. A notice at the top of the workspace says from which day it requires two-step sign-in, with a **Set it up** button that opens **Settings** > **Account**.
- **Once the rule applies to them**, the workspace is locked for them. They can't open anything in it, not even to read it: chats, files, projects, tasks, pages, memory and the workspace's settings. Instead, on the web and in the phone app, Bluedeer shows why it is locked, a **Set up two-step sign-in** button, and their other workspaces to switch to. The workspace list marks the workspace **Locked**. Their own **Settings** and **Settings** > **Account** stay open, so they can set one up.

The 7-day notice and the lock show on every screen of the workspace, on the web and in the phone app. On the phone, the notice can be closed until the app is opened again.

Someone whose account is connected to the workspace's single sign-on, but who signed in with a password, Google or Apple, is told to sign out and sign in again with their company's single sign-on, or to set up two-step sign-in or a passkey.

They keep their account and their place in the workspace. Nothing in the workspace is deleted, and their personal workspace and other workspaces are not affected. As soon as they turn on two-step sign-in, add a passkey, or sign in with the workspace's single sign-on, the workspace opens for them again.

## When someone turns their second step off later

If a member turns off two-step sign-in and has no passkey, or removes their last passkey while two-step sign-in is off, the workspace is locked for them again. Before they do it, Bluedeer warns them which workspaces they will lose access to, and they can cancel. A member signed in with the workspace's single sign-on isn't warned about that workspace, since that sign-in still opens it; their next sign-in with a password, Google or Apple will need a second step again.

## Turn it off

Select **Turn off** under **Require two-step sign-in** and confirm. Members no longer need a second step to open the workspace, and anyone the rule locked out can open it again straight away.

## See what changed

Turning the rule on or off, and every person it locks out or lets back in, appears in the workspace's activity under **Security**. See [See a workspace's activity](https://support.bluedeer.ai/team/administration/workspace-activity.md).