Overview
Two-factor authentication (2FA) adds a second verification step after a user enters their password. Even if a password is compromised, an attacker cannot access the account without also having the second factor.2FA can be enforced organization-wide by an administrator or enabled voluntarily by individual users. When enforced, users must set up 2FA before they can access Fentu FSM.
Supported Second Factors
| Method | How It Works | Recommended For |
|---|---|---|
| Authenticator App (TOTP) | Time-based one-time code generated by an app (Google Authenticator, Microsoft Authenticator, Authy) | All users — most secure option |
| Email OTP | One-time code sent to the user’s registered email address | Users without a smartphone |
| SMS OTP | One-time code sent via text message | Fallback option when email is unavailable |
Enforcing 2FA Organization-Wide
Administrators can require all users to set up 2FA before accessing Fentu FSM:Set Grace Period
Optionally set a grace period (e.g., 7 days) during which existing users can still log in without 2FA while they set it up
Setting Up 2FA (Per User)
Users can set up 2FA from their own profile, or be prompted automatically when enforcement is active.Using an Authenticator App (TOTP)
Scan the QR Code
Open your authenticator app (Google Authenticator, Microsoft Authenticator, or Authy) and scan the QR code displayed on screen
Enter the Verification Code
Type the 6-digit code shown in your authenticator app to confirm the setup
Save Recovery Codes
Download or copy the recovery codes shown. Store them in a secure location. These are used if you lose access to your authenticator device
Using Email OTP
Confirm Your Email Address
Verify the email address shown is correct. A test code is sent immediately
Logging In with 2FA
Once 2FA is active, the login flow has an additional step:Second Factor Prompt
After password verification, a prompt appears asking for your second factor code
Enter the Code
Open your authenticator app (or check your email/SMS) and enter the current 6-digit code
TOTP codes are valid for 30 seconds. If a code is rejected, wait for the next code to generate and try again. Ensure your device clock is accurate — TOTP codes depend on time synchronisation.
Recovery Codes
Recovery codes are one-time-use backup codes generated when 2FA is first set up. Use them if you lose access to your authenticator device or email.Using a Recovery Code
- On the 2FA prompt, click “Use a recovery code instead”
- Enter one of your saved recovery codes
- You are logged in — the used code is invalidated immediately
- After logging in, go to Profile > Security and re-enrol a new second factor or generate new recovery codes
Regenerating Recovery Codes
If you suspect your recovery codes are compromised:- Go to Profile > Security
- Click “Regenerate Recovery Codes”
- Save the new codes — the previous set is immediately invalidated
Resetting 2FA for a User (Admin)
If a user loses access to their second factor and does not have recovery codes, an administrator can reset their 2FA:Only administrators with the User Management permission can reset another user’s 2FA. All resets are recorded in the audit log.
2FA and SSO
When SSO is enabled, the identity provider handles the authentication flow — including any MFA requirements configured in the IdP. In this case:| Scenario | 2FA Handling |
|---|---|
| SSO only | MFA is managed entirely by your identity provider (Entra ID, Okta, etc.). Fentu FSM 2FA is bypassed |
| SSO + Fentu 2FA | Users complete IdP MFA, then are prompted for a Fentu 2FA code as well. Not recommended — configure MFA at the IdP level instead |
| Local login (no SSO) | Fentu FSM 2FA applies in full |
Troubleshooting 2FA
| Symptom | Likely Cause | Resolution |
|---|---|---|
| ”Invalid code” on correct-looking code | Device clock is out of sync | Sync your device time settings (Settings > Date & Time > Automatic) |
| Code rejected immediately after setup | QR code scanned incorrectly | Delete the entry from your authenticator app and re-scan |
| No email OTP received | Email in spam folder, or wrong email on account | Check spam; verify email address in Profile settings |
| Locked out, no recovery codes | Lost device and no codes saved | Contact your Fentu FSM administrator to reset 2FA |
| 2FA prompt does not appear | 2FA not yet enforced or user exempt | Check Security settings; verify user is not in the exempt list |
Related Documentation
Single Sign-On (SSO)
Authenticate users through your organization’s identity provider
User Management
Manage user accounts, roles, and security settings