Two-factor authentication (2FA) can be enforced account-wide at any time to ensure the overall security and protection of your services. To use International Dialing, you must enforce MFA. This solution is also an option for our Multifactor Authentication (MFA) Policy, which we are rolling out in phases.

You can set 2FA at the user level before it is enforced account-wide:

• If you set it before 2FA is enforced, your verification phone number remains in effect once applied account-wide.
• If you set it after 2FA is enforced, you are prompted to enter a verification phone number for future sign-ins once it is applied account-wide. 

To set your verification phone number:

Only an Account Super User (ASU) with 2FA or SSO enabled on their profile can force a reset for any account user, except their own. If you are an ASU, you must Contact Us to reset. All resets require authorization from the actual user. 

Reset a phone number for a user as follows:

1. Receive authorization from the actual user. 
2. Sign in to the Admin Portal (as ASU). 
3. Click Phone System, then click Users.
4. Select the user you want to reset, then click Security.
5. Scroll to Two-Factor Authentication, then click Remove Number.
   
   Once the number is removed, the user is prompted to enter a new phone number on their next sign-in.  
   
   BEST PRACTICE: Always perform a password reset if the user suggests their 2FA has been compromised. 

Can I remove or disable 2FA?
Our Multifactor Authentication (MFA) Policy requires account-wide enforcement of two or more verification factors to safeguard systems against unauthorized access.  Whether you use 2FA or another method such as Passkeys, MFA cannot be removed or disabled. 

I was not prompted for a verification code when I signed in. Why?
We use continuous, intelligent, real-time security monitoring to evaluate ALL sign-in attempts, and you are always protected from unauthorized sign-in attempts.

• If a sign-in is low risk (e.g., signing in from a recognized device and location), the verification code may be bypassed. This feature is intentional.
• If a sign-in detects any risk indicator (e.g., an unrecognized device, unusual location, or other alert factors), a prompt will appear for your verification code.

How often am I required to authenticate with an MFA solution such as 2FA? Is it every 24 hours? 
The frequency of prompts is determined by our security system’s assessment of your sign-in attempt. The system evaluates risk indicators to determine when re-verification is necessary.

Can I update/change the phone number I use for 2FA?
Contact your Account Super User (ASU) for assistance. If you are an ASU, you must contact us to reset it. All reset requests require authorization from the actual user. 

Can I set up 2FA with an email address instead of a phone number?
No. Email addresses are more vulnerable to interception and cyberattacks compared to other verification methods. A mobile phone number is required.

I have a user who has left the company. Can I reset 2FA to retrieve their data, such as text messages, business contacts, and so on?
To gain access to a departed user, the ASU must reset both the Password and 2FA for that user.  

Do VBC API users adhere to an MFA Policy such as 2FA? 
No. This policy does not impact VBC API users.

When 2FA is enabled account-wide, why am I signed out of all active sessions? 
When an MFA Policy is enforced account-wide, all users who are not signed in with Single Sign-On (SSO) or 2FA (or other MFA) at the user level are signed out of all active sessions. On their next sign-in attempt, non-MFA users will be prompted to set up their verification method.

If our account uses Single-Sign-On (SSO), why must we enforce your Multifactor Authentication (MFA) policy?
SSO always overrides our MFA Policy; however, if any user is disabled for SSO, they automatically default to the MFA policy. In this instance, if disabled for SSO and 2FA is enforced account-wide, they will be prompted to enter a phone number for their verification code on their next sign-in attempt.

Is there a way to determine which users have 2FA enabled at the user level before it is enforced account-wide?
No, but these users will not be affected when it is enabled. Instead, only users without Single Sign-On (SSO) or 2FA enabled at the user level are impacted. On their next sign-in attempt, these users will be prompted to set up their verification method.

Can I use an international phone number for 2FA?
Yes. See Supported Countries for the current list.

What is your data retention/compliance policy for phone numbers used for 2FA?
The phone numbers used for 2FA are stored in our system; however, they are not exposed to anyone after setup. These phone numbers are not used for any other purpose.