> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pastahr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Multi-Factor Authentication (MFA) in PastaHR

> Add a second verification layer to PastaHR with MFA. Learn how to enable it org-wide and how team members complete the first-time setup.

In addition to the email login code that all users receive, team members must enter a time-based one-time password generated by an authenticator app on their mobile device when MFA is enabled. Even if someone intercepts a login code, they cannot access PastaHR without physical access to the registered device.

## Enabling MFA for Your Organisation

MFA is not enabled by default. To turn it on for your PastaHR workspace, an Admin must contact the PastaHR support team:

**Email:** [support@pastahr.com](mailto:support@pastahr.com)

Include your company name and the workspace you'd like MFA enabled for.

<Warning>
  Once MFA is enabled for your organisation, all users will be required to complete MFA setup on their **next login**. Let your team know ahead of time before you request activation, so no one is caught off guard.
</Warning>

## First-Time MFA Setup for Users

When a user logs in for the first time after MFA has been enabled, or when a new user accepts an invitation after MFA is already active, they are automatically guided through the setup process.

<Steps>
  <Step title="Install an authenticator app">
    Before setup, the user needs one of the supported authenticator apps on their mobile device.

    <CardGroup cols={2}>
      <Card title="Google Authenticator" icon="google" href="https://support.google.com/accounts/answer/1066447" />

      <Card title="Microsoft Authenticator" icon="microsoft" href="https://www.microsoft.com/en-us/security/mobile-authenticator-app" />
    </CardGroup>
  </Step>

  <Step title="Scan the QR code">
    During the login or account acceptance flow, PastaHR displays a QR code on screen. The user opens their authenticator app, taps **Add account** (or the **+** button), and selects **Scan a QR code**. They then point their camera at the QR code shown by PastaHR.
  </Step>

  <Step title="Enter the one-time password">
    After scanning, the authenticator app immediately begins generating six-digit codes for the PastaHR account. The user enters the current code into the PastaHR confirmation field to verify the setup was successful.
  </Step>

  <Step title="Setup complete">
    MFA is now linked to the user's account. On every future login, they will be asked for a code from their authenticator app after the email login code.
  </Step>
</Steps>

<Tip>
  Advise your team members to enable **cloud backup** in their authenticator app (available in Google Authenticator and Microsoft Authenticator). This way, if they lose or replace their phone, they can restore their MFA accounts without being locked out of PastaHR.
</Tip>

## Recovering a Locked Account

If a user no longer has access to their authenticator app and can't generate an MFA code, they can't complete the login flow. An Admin can reset MFA for any team member directly from the Settings panel.

<Steps>
  <Step title="Go to Settings → Members">
    Log in to PastaHR as an Admin and navigate to **Settings** in the left sidebar, then click **Members**.
  </Step>

  <Step title="Open the actions menu for the affected user">
    Find the locked-out team member and click the **three-dot menu (⋮)** next to their name.
  </Step>

  <Step title="Select Reset MFA">
    Select **Reset MFA** from the menu.
  </Step>

  <Step title="User re-enrolls on next login">
    The next time that person logs in, they will be asked to set up MFA again from scratch.
  </Step>
</Steps>

<Note>
  If you are the only Admin and you yourself are locked out, contact [support@pastahr.com](mailto:support@pastahr.com) for assistance.
</Note>