Resetting 2FA

Site Administrators can reset a user's enrolled 2FA methods. Workspace Administrators can do so for users within their Workspace. Group Admins need the site's edit and password-reset capabilities, and the user's Primary Group must be one they administer. Group Admins cannot reset 2FA for accounts with Site Administrator, Read-only Site Administrator, or Workspace Administrator access on the Group Admin's own site. Partner Admins can reset methods within their Partner when Allow credential changes is enabled.

A parent-site account with Child Site Administrator access remains subject to these parent-site account-management permissions. That grant does not prevent an eligible Group Admin on the Parent Site from resetting its 2FA.

Reset 2FA when a user's 2FA device is lost or the user needs to configure a new 2FA method.

To trigger a reset through the web interface, edit the user's Two-factor authentication settings and choose Reset this user's 2FA methods. All of the official Files.com SDKs also provide a method for triggering this reset. The reset uses re-authentication to confirm the acting administrator's identity before removing the user's existing methods. When prompted, the administrator verifies with their own password or active 2FA method. API-key authentication and the documented SSO exceptions satisfy this control without a password or 2FA challenge.

A user whose 2FA has been reset is prompted to create a new 2FA method on the next login through the web portal, if they are required to have a 2FA method.