Last updated: 2026-10-18 · 6 min read

Two-Factor Authentication and IP Access Restrictions

Manage your own two-factor authentication under Personal settings → Security. Review workspace-wide rules under Workspace settings → Security.

Setting	Who can use it
Your authenticator and recovery codes	You
Workspace policy, enrollment counts, and security history	OWNER and ADMIN
MFA requirements and allowed IP changes	OWNER only

Register an authenticator

Open Security in your personal settings and choose to set up two-factor authentication
Scan the QR code with your authenticator. If you are using the same phone or cannot scan the QR code, enter the setup key manually in the authenticator
Enter its current six-digit code and verify
Copy the recovery codes or save them as a text file, and store them securely
Check that you have saved your recovery codes and finish enrollment
Follow the prompt to sign in again and verify with your authenticator

If you already have an authenticator, choose to change it. You may need to sign in again and verify with your current authenticator before changing it.

Keep QR codes, setup keys, authentication codes, and recovery codes out of other people's messages and AI chats. Complete enrollment and changes yourself in your signed-in screen.

When a verification screen appears after sign-in, enter the authenticator's current six-digit code. If you cannot use the app, switch to using a recovery code and enter one unused code. Each code works only once.

Save recovery codes when they are displayed. Your personal Security page shows how many remain; it does not provide an action to display previously saved codes again. If copying fails, select and save the codes manually or use the text download.

If you lose both the authenticator and every recovery code, this feature cannot restore access. Keep your recovery codes in a safe place separate from the authenticator.

Regenerate recovery codes

Choose to regenerate recovery codes on your personal Security page and confirm. Every old recovery code becomes invalid, and all devices need to sign in again. Save the new codes, acknowledge that you have saved them, and sign in again.

Disable two-factor authentication

Choose to disable two-factor authentication and confirm. You must then sign in again. You cannot disable it while a workspace you belong to requires it.

Require MFA for a workspace

OWNER and ADMIN can review the configured and unconfigured member counts under Workspace settings → Security. OWNER can change whether members must use two-factor authentication. Enabling this requirement makes members who have not enrolled register an authenticator.

This policy applies to workspace members. It does not apply the same setting to external recipients who do not belong to the workspace.

Restrict access by IP

When access is restricted to allowed IPs, workspace members connect through the permitted company network or VPN.

Open Workspace settings → Security and review your current IP and whether it is included in the allowed list
Add the public IP address or CIDR supplied by your company, with an optional name
Before enabling IP restrictions, ensure the allowed list includes your current IP
Review the MFA and IP changes and their impact on members, acknowledge the impact, and save

Public IPv4, IPv6, and CIDR entries are supported, with up to 50 entries. Private IPs and an allow-everything /0 are not accepted. If a broad-network warning appears, verify that your company controls the whole range. Remove an entry with its Delete action and save the changes.

Saving changes requires a sign-in and authentication-code verification within the last five minutes. ADMIN can review settings but cannot save. If the current IP would not be allowed when saving IP restrictions, the settings are not saved.

Security history

The same workspace Security page shows events such as policy changes and denied access. For general activity history, see Audit logs.

Troubleshooting

Message or situation	What to do
Invalid code	Check the authenticator's current code or use an unused recovery code
Too many attempts	Wait until the displayed retry time before trying again
Verification expired or started in another browser	Sign in again and restart in the same browser
Verification required before a setting change	Complete the requested sign-in or code verification, then try the action
This network cannot access the workspace	Connect to the permitted company network or VPN; ask OWNER if you cannot connect
Another administrator changed the settings	Reload and review your changes against the latest settings
Saved, but the latest state could not be loaded	Fetch the settings again to confirm the result
Security settings are being prepared	Return later; do not assume a change was saved

An MCP token does not replace these personal verification steps. Enroll authenticators, enter codes, save recovery codes, disable MFA, and change workspace security policy in your own signed-in screen. See MCP connection for connection guidance and Workspace settings for the settings overview.

Check security status through MCP

With an all-room token carrying workspace:read, call get_my_profile with {"input":{"view":"security"}} to check your authenticator enrollment, whether MFA is required by any workspace you belong to, and your remaining recovery-code count. The requirement reflects all of your memberships, not only the token's workspace.

Current OWNER and ADMIN members of the token's workspace can call get_workspace_settings with {"view":"security"} to read the MFA and allowed-IP policy, enrollment counts, and summaries of up to 50 recent security events. Event details and credentials are not returned. canConfigureInApp describes environment readiness; it does not mean that you have completed verification or that your current IP is allowed. canEditInApp indicates OWNER permission. Actual changes still require verification in your signed-in screen.

Omitting view retains the existing profile and basic workspace-settings reads and their existing permissions. MCP does not receive authenticator secrets, verification codes, recovery codes themselves, your current browser IP, or your personal verification state.