Engineering / ENG-1473
Require MFA enrolment before an administrator's first token
Description
An administrator can create API keys and get API tokens. From 11 June that shouldn't work around MFA.
Acceptance criteria
- An administrator who signs in with a password and hasn't set up an authenticator can't create an API key or get a token until they have.
- Keys made before stay valid; their owners are asked to enrol at their next sign-in.
- Single sign-on administrators: unchanged (their company's MFA covers them).
Merged. Goes out with the MFA release on Thursday.