Require a second factor for everyone
A password alone isn’t enough for a workspace with customer conversations and phone numbers in it. With multi-factor authentication required, everyone proves it’s them with a second step: a passkey, an authenticator app, their phone, or a code by email. This turns it on for Northwind Traders and gets the team set up with the strong options before the first prompt. An owner or admin does it.
Before you start
Section titled “Before you start”- Requiring multi-factor authentication comes with every paid plan.
- Set up your own second step first (step 1): Freesbe asks you to verify before it lets you require it, so you can’t lock yourself out.
- Scripts that signed in with a password lose access to the workspace until they verify. Move them to an app token.
1. Set up your own strong second step
Section titled “1. Set up your own strong second step”Pick one, or both:
- A passkey: in your web browser, go to Preferences → My account → Sign-in → Passkeys, click Add a passkey and follow the browser’s prompts. Passkeys marked Synced work on your other devices too.
- An authenticator app: open Preferences → My account → Sign-in → Authenticator app, click Set up an authenticator app, scan the QR code with Google Authenticator, Microsoft Authenticator, 1Password, Authy or similar, enter the 6-digit code and click Turn on.
As an admin you’ve likely done this already: opening the Admin Center always takes a passkey, a phone approval or an authenticator code, on every plan.
2. Ask the team to set up their phone
Section titled “2. Ask the team to set up their phone”The easiest second step for most people is their phone. Right after someone signs in to the mobile app, it offers to approve their sign-ins: they tap Turn on and confirm with their fingerprint or face. Anyone who tapped Not now turns it on later from the You tab (their profile picture at the bottom) under Approve sign-ins.
From then on, when a computer asks them to verify, it shows a two-digit number, their phone gets Is this you signing in? with where the sign-in is from, and they tap the matching number. It works for the web app and the desktop app, and they can even skip the password with Approve on my phone instead on the sign-in page.
Send a message like this:
Next week Freesbe starts asking for a second step when you sign in. Open the Freesbe app on your phone, tap your picture at the bottom and turn on Approve sign-ins: then it’s one tap on your phone. Or add a passkey in Preferences → My account → Sign-in → Passkeys. Never approve a sign-in you didn’t start.
3. Turn it on
Section titled “3. Turn it on”- Open Workspace settings → Security & compliance → Sign-in → Multi-factor authentication.
- Switch on Require multi-factor authentication. If you haven’t verified a second step in this session yet, Freesbe asks you to first.
- Under Ask again, choose how often members verify: Only when signing in, Each time Freesbe opens (every start of the desktop app or new browser tab), Every 12 hours, Every day or Every week. Every day is a fair start for a team on laptops.
What changes for people
Section titled “What changes for people”- Anyone using the workspace who hasn’t verified is signed out of that workspace right away and sees Verify it’s you the next time they open it. Other workspaces aren’t affected.
- Signing in with a passkey, Google or Microsoft counts by itself. When the time comes to verify again, these people verify like everyone else.
- People who signed in with an emailed sign-in code can’t use another emailed code as the second step. They use their password, a passkey, their phone or the authenticator app.
- Someone with nothing else to verify with sets up a passkey or an authenticator app on the spot.
- Adding or removing a passkey, the authenticator app or an approving phone asks them to verify again if they haven’t in the last hour, so someone who only knows the password can’t add their own.
- Changing Ask again to ask more often needs your own session to meet the new rule first.
- Emailed codes work for 10 minutes; authenticator codes change every 30 seconds. Too many wrong codes in a day locks that way of verifying until tomorrow.
- Lost phone? The person verifies with an emailed code, then removes the old phone under Preferences → My account → Sign-in → Approve sign-ins on your phone and sets up the new one. If every admin has lost their passkeys and phones, contact Freesbe support.
- Pair it with single sign-on and email domains to cover the whole company.
See Multi-factor authentication and Approve sign-ins on your phone for the details.
Answers come from the Freesbe guides and are written by AI, so check the linked guide before relying on one. Please don't include personal details such as emails or passwords.