> ## Documentation Index
> Fetch the complete documentation index at: https://reedai-07fa30f1.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-Factor Authentication and SSO

> Secure your ZeroTwo account with 2FA and enterprise Single Sign-On options

Enhance your account security with two-factor authentication (2FA) or streamline access with enterprise Single Sign-On (SSO).

## Two-Factor Authentication (2FA)

Add an extra layer of security by requiring a second verification method when logging in.

### Enabling 2FA

<Steps>
  <Step title="Open security settings">
    Navigate to Settings → Account → Security
  </Step>

  <Step title="Choose 2FA method">
    Select your preferred authentication method:

    * Authenticator app (recommended)
    * SMS text message
    * Email code
  </Step>

  <Step title="Set up authentication">
    Follow the setup process for your chosen method.

    **For authenticator apps:**

    1. Scan the QR code with your app (Google Authenticator, Authy, etc.)
    2. Enter the 6-digit code from your app
    3. Save backup codes

    **For SMS:**

    1. Enter your phone number
    2. Verify with the code sent via text
    3. Save backup codes

    **For email:**

    1. Verify your email address
    2. Codes will be sent to your registered email
    3. Save backup codes
  </Step>

  <Step title="Save backup codes">
    <Warning>
      **Important:** Save your backup codes in a secure location. You'll need them if you lose access to your primary 2FA method.
    </Warning>

    Store backup codes:

    * In a password manager
    * Printed and stored securely
    * In a secure note-taking app
  </Step>

  <Step title="2FA enabled">
    <Check>
      Your account is now protected with two-factor authentication.
    </Check>
  </Step>
</Steps>

### Using 2FA

When logging in with 2FA enabled:

1. Enter your email and password
2. Enter the 6-digit code from your authenticator app, SMS, or email
3. Check "Trust this device" to skip 2FA for 30 days on this device (optional)
4. Complete login

<Info>
  Trusted devices are cleared when you change your password or disable 2FA for security reasons.
</Info>

### Managing 2FA

**Change 2FA method:**

1. Settings → Security → Two-Factor Authentication
2. Click "Change Method"
3. Select new method and complete setup

**Disable 2FA:**

1. Settings → Security → Two-Factor Authentication
2. Click "Disable 2FA"
3. Confirm with password and current 2FA code

**Regenerate backup codes:**

1. Settings → Security → Two-Factor Authentication
2. Click "Generate New Backup Codes"
3. Save the new codes securely

<Warning>
  Regenerating backup codes invalidates all previous codes.
</Warning>

### Troubleshooting 2FA

<AccordionGroup>
  <Accordion title="Lost access to authenticator app">
    **Solution:**

    1. Use a backup code to log in
    2. Go to Security settings
    3. Reconfigure 2FA with a new device
    4. Generate new backup codes
  </Accordion>

  <Accordion title="Backup codes not working">
    **Solution:**

    * Ensure you're using codes from the most recent generation
    * Check for typos (codes are case-sensitive)
    * Verify you haven't already used the code (single-use only)
    * Contact support if all codes fail
  </Accordion>

  <Accordion title="Not receiving SMS codes">
    **Solution:**

    * Check phone has cell signal
    * Verify phone number is correct
    * Check SMS isn't blocked by carrier
    * Try switching to authenticator app method
    * Use a backup code to access account
  </Accordion>
</AccordionGroup>

## Single Sign-On (SSO)

Enterprise Single Sign-On allows organizations to manage authentication centrally through their identity provider.

<Info>
  SSO is available on Enterprise plans only. Contact sales for more information.
</Info>

### Supported identity providers

ZeroTwo supports standard SAML 2.0 and OAuth 2.0 identity providers:

* **Okta**
* **Azure Active Directory / Microsoft Entra ID**
* **Google Workspace**
* **OneLogin**
* **Auth0**
* **Custom SAML 2.0 providers**

### Setting up SSO (Admin)

<Steps>
  <Step title="Access admin console">
    Navigate to Organization Settings → Security → Single Sign-On
  </Step>

  <Step title="Choose provider">
    Select your identity provider from the list or choose "Custom SAML 2.0"
  </Step>

  <Step title="Configure provider">
    Enter required information:

    * SSO URL / Login URL
    * Entity ID / Identifier
    * X.509 Certificate

    **For SAML 2.0:**
    Download ZeroTwo's metadata or manually configure:

    * ACS URL (Assertion Consumer Service)
    * Entity ID
    * Audience URI
  </Step>

  <Step title="Test connection">
    Use the "Test SSO" button to verify configuration before enabling for all users.
  </Step>

  <Step title="Enable SSO">
    <Check>
      SSO is now active for your organization. Users can log in through your identity provider.
    </Check>
  </Step>
</Steps>

### User experience with SSO

When SSO is enabled for your organization:

1. Go to zerotwo.ai and click "Sign In"
2. Enter your work email
3. You're redirected to your organization's login page
4. Authenticate with your company credentials
5. You're redirected back to ZeroTwo, logged in

<Tip>
  Bookmark your organization's custom SSO login URL for faster access.
</Tip>

### SSO configuration options

**Provisioning:**

* Automatic user provisioning (SCIM)
* Just-in-time (JIT) provisioning
* Manual user management

**Access control:**

* Enforce SSO for all organization members
* Allow password fallback for admins
* Configure session timeouts
* Require re-authentication intervals

**Attribute mapping:**

* Map user attributes from IdP to ZeroTwo
* Assign roles based on IdP groups
* Sync profile information

### SSO security features

<Check>
  **Security benefits:**

  * Centralized authentication management
  * Single point for access control
  * Consistent password policies
  * Automatic deprovisioning when users leave
  * Audit logging of authentication events
  * Conditional access policies
</Check>

### Troubleshooting SSO

<AccordionGroup>
  <Accordion title="SSO login fails">
    **Solutions:**

    * Verify SSO configuration in both ZeroTwo and IdP
    * Check certificate is valid and not expired
    * Ensure URLs are correct (no trailing slashes)
    * Test with admin account first
    * Check IdP logs for error details
    * Verify user is assigned to ZeroTwo application in IdP
  </Accordion>

  <Accordion title="Users can't access after SSO enabled">
    **Solutions:**

    * Ensure users are provisioned in ZeroTwo
    * Check IdP application assignment
    * Verify email addresses match
    * Enable JIT provisioning if not using SCIM
    * Check organization SSO settings allow access
  </Accordion>

  <Accordion title="Certificate errors">
    **Solutions:**

    * Verify certificate format (PEM)
    * Ensure certificate includes header/footer
    * Check certificate hasn't expired
    * Download fresh certificate from IdP
    * Remove extra whitespace or characters
  </Accordion>
</AccordionGroup>

## Best practices

<Steps>
  <Step title="Use 2FA always">
    Enable 2FA even if your organization uses SSO for additional security.
  </Step>

  <Step title="Save backup codes">
    Store backup codes securely and update them when regenerated.
  </Step>

  <Step title="Use authenticator apps">
    Authenticator apps are more secure than SMS for 2FA.
  </Step>

  <Step title="Regular audits">
    Periodically review authorized devices and sessions.
  </Step>

  <Step title="Test SSO changes">
    Always test SSO configuration changes with a test account before rolling out to all users.
  </Step>
</Steps>

## Related pages

<CardGroup cols={2}>
  <Card title="Profile settings" icon="user" href="/account/profile-and-login">
    Manage account information
  </Card>

  <Card title="Organization settings" icon="building" href="/projects/org-settings">
    Configure organization security
  </Card>

  <Card title="Privacy" icon="shield" href="/privacy/data-and-compliance">
    Data security information
  </Card>

  <Card title="Roles and permissions" icon="users-gear" href="/projects/roles-and-permissions">
    Access control
  </Card>
</CardGroup>