MFA policy
By Mira Holm · created 15 May 2023, 13:00 UTC · last updated 20 Oct 2026, 09:30 UTC · version 7
mfapolicysecurity
Owner: Mira Holm
For people at ACME
Every work account uses MFA. No exceptions.
| System | How |
|---|---|
| Google Workspace | Authenticator app or security key; administrators must use a security key |
| AWS | Through single sign-on from Google Workspace, with its MFA |
| GitHub | Two-factor required by the organisation |
| Jira and Confluence | Through Google Workspace |
| Mailcrest and Textbridge consoles | Their own MFA, authenticator app |
| Emargen | Through Google Workspace |
In our product
| Who | MFA |
|---|---|
| Customers' administrators signing in with a password | Required since 11 June 2026: a code from an authenticator app (MFA for administrators) |
| Anyone signing in through Entra ID or Okta | Their company's MFA covers it |
| Depot workers on phone codes | The SMS code is the sign-in; it is not a second factor |
| Others signing in with a password | Not required. Customers who want MFA for everyone get it through single sign-on |
Not available
- Hardware keys (FIDO2) for customers' administrators. "Hardware keys for administrators" became an idea on 19 October, after Halden asked.
- SMS as a second factor. We won't offer it.