What Is Multi-Factor Authentication?

ProtoPie Cloud’s Multi-Factor Authentication (MFA) adds an extra layer of security for users who sign in with an email address and password. In addition to their password, users must enter a 6-digit code from an authentication app, such as Google Authenticator, 1Password, or Microsoft Authenticator.

• Service Admins enable or disable MFA for the entire organization. Individual users cannot turn it off for their own accounts while the organization requires it.

• ProtoPie MFA does not apply to users who sign in through SSO (SAML or OIDC), Google, or Apple. MFA for these users is controlled by their identity provider, such as Okta, Microsoft Entra ID, or Google.

• Accounts provisioned through SCIM sign in through SSO, so ProtoPie MFA does not apply to them. ProtoPie MFA is required only on the email-and-password sign-in path. Refer to the SCIM documentation for more details.

How to Enable MFA for your Organization

☝️ For: Service Admins

1. Go to Organization settings → Authentication → Login & Authentication, then click Email & Password.

   

2. Select the Multi-factor authentication checkbox.

   

   
   

3. Click Update at the bottom of the screen. In the Warning: Update authentication settings confirmation window, review the information and click Update.

   
   

   

💡What happens immediately after MFA is enabled

• Users who have not registered an authentication app receive a one-time email explaining that they must register one the next time they sign in. This is the email referenced by “They all get an email…” in the confirmation window. The email is not sent again if MFA is turned off and back on later the same day.

• The next time users sign in with an email address and password, users who are not enrolled see the registration screen, while enrolled users see the code-entry screen. Existing login sessions remain active.

• While the organization requires MFA, individual users cannot disable it for their own accounts.

• Service Admins are subject to the policy as well. If your organization has only one Service Admin, appoint a second one before enabling MFA to avoid losing access to the organization.

• Deactivated accounts cannot complete MFA enrollment.

How to Register an Authentication App on First Login

☝️ For: ProtoPie Users

1. Sign in with your email address and password as usual.

2. On the Multi-factor authentication screen, scan the QR code with your authentication app. If you cannot scan it, click Copy key and enter the setup key manually in the app. Then click Next.

3. On the Enter the 6-digit code screen, enter the code from your authentication app and click Verify.

4. On the Save your backup codes screen, save all 10 backup codes in a secure place by clicking Copy or Download. Then click Next.

☝️You can view these codes again at any time in Account settings → View backup codes, where each code shows whether it has already been used. Each code is a combination of digits and uppercase letters, with no hyphens.

5. On the MFA is on for your account screen, click Continue to ProtoPie to finish signing in.

☝️You must complete authentication within 10 minutes. The same 10-minute limit applies to enrollment, code verification at sign-in, backup code verification, and new device setup.

How to Enter the 6-Digit Code When Signing In

☝️For: ProtoPie Users

1. After entering your email address and password, the Enter the 6-digit code screen appears. Enter the current code from your authentication app and click Verify.

   

2. If you cannot access your authentication app, enter one of your backup codes instead. Each backup code can be used only once.

   
   

   

   
   

💡 The limit is fixed at five consecutive attempts followed by a 10-minute lockout, and Service Admins cannot change it in the admin console.

How to Switch Devices or Regenerate Backup Codes

☝️ For: ProtoPie Users

If you change phones or uninstall your authentication app, you can register a new device without immediately invalidating your existing setup.

1. Go to Account settings → Multi-factor authentication. The page shows your current MFA status and the number of backup codes remaining, such as 7 of 10 remaining.

   
   

   

2. Click Set up a new device.

3. Scan the QR code with the new device, or enter the setup key manually. Click Next, enter the 6-digit code, and click Verify. Your existing authentication app remains valid until the new setup is confirmed. The QR code expires after 10 minutes.

   
   

   

   
   

   

4. After the 6-digit verification, ProtoPie issues a new set of backup codes. Save them securely, then click Next to return to the status screen. All previous backup codes become invalid. You remain signed in after registering a new app.

To review or replace only your backup codes, click View backup codes on the Account settings. The screen lists all 10 codes and marks the ones you have already used. Click Regenerate code to issue 10 new codes; all previous codes expire immediately, and you can regenerate again later. You can regenerate codes even when your organization requires MFA.

How to Reset MFA

Reset Your Own MFA

☝️ For: ProtoPie Users

If you can still sign in with your authentication app or a backup code, you can reset your own MFA.

1. Go to Account settings → Multi-factor authentication.

2. Click Set up a new device and register your new authentication app.

If you lose access to both your authentication app and backup codes, you cannot recover the account yourself. Follow the instructions on the code-entry screen and ask a Service Admin to reset your MFA. If every Service Admin has lost access to the organization, contact ProtoPie Support for recovery.

Reset a User’s MFA

☝️ For: Service Admins

1. Go to Organization settings → People, find the user, and open the ⋯ menu at the right end of their row.

   

   
   

   

2. Click Reset MFA. The user must then sign in with their password and complete MFA enrollment again.

   

   
   🔒 Reset MFA only after verifying the user’s identity. Immediately after a reset, anyone who knows the account password can register a new authentication device.

How to Check Enrollment Status

☝️ For: Service Admins

Go to Organization settings → People to view each user’s status in the MFA column. Use the MFA filter at the top to show all users, enrolled users, or users with pending enrollment. You can also view MFA information in each user’s member details.

• Enrolled: The user has completed MFA registration.

• Pending: The user is eligible for MFA but has not registered yet. They will be prompted during their next sign-in.

• Not applicable: The user signs in only through SSO or social login, so ProtoPie MFA does not apply.

• Disabled: Organization-wide MFA is turned off.

Frequently Asked Questions

• Do users who sign in through SSO need to enter a ProtoPie MFA code? No. Their MFA requirements are controlled by the identity provider’s policy.

• What happens to enrollment information if organization-wide MFA is turned off? Existing enrollment information remains stored, but ProtoPie does not request a code during sign-in. If MFA is turned on again, the existing enrollment takes effect immediately.

• Can one account be registered on multiple devices? Only one registration is supported.

• Can a Service Admin change the lockout duration? No. The admin console does not provide this option. Five consecutive failed attempts trigger a fixed 10-minute lockout.

• Can I see my backup codes again after enrollment? Yes. Go to Account settings → View backup codes to see all 10 codes and which ones have been used, or click Regenerate code to replace them.