Two-factor authentication and passkey policy

Enable passwordless passkey sign-in, two-factor authentication or both, globally or per domain; set enforcement and the transition period; reset the device registrations of a user who lost a device.

Global administratorAdmin console › Tools and Migration › 2FA / Passkey Policy

User side: Two-factor authentication, Signing in with a passkey.

Modes

Mode	Behaviour
off	Passkeys and second step off (default).
passwordless	Passwordless sign-in with a passkey.
2fa	Second step (TOTP or passkey) after the password.
both	Both; the user signs in with whichever they set up.

Turning it on without locking users out

1. Click Tools and Migration › 2FA / Passkey Policy in the left tree. Global (default) is at the top, all domains below; each row shows Mode, 2FA enforced and Source (Own setting / Inherited from global).
2. Click the domain's row. The Passkey Domain Policy window opens.

2FA / Passkey Policy: global and domain rows

1. Mode: Two-factor (2FA); Enforce (block unenrolled users in 2FA/both mode): unticked. This is the transition mode: users who registered are asked for the second step, those who have not yet sign in with their password.
2. OK. Once registrations are complete, tick Enforce in the same window.

The Passkey Domain Policy window

The modes in the list are Off, Passwordless, Two-factor (2FA), Both and Inherit global (remove domain override). A mode saved for a domain overrides the global setting; Inherit global removes the domain setting. To change the global default, click the Global (default) row.

Enforced and not yet registered

With enforcement on, a user who has not set it up is not blocked; after their password, the setup screen opens and the session starts when setup is done.

Lost device: reset

1. Click Tools and Migration › Profelis 2FA in the left tree and enter the user's address in Account.
2. Press Reset 2FA. TOTP, scratch codes and trusted devices are cleared.
3. The user registers again at the next sign-in.

Profelis 2FA: resetting one account

To delete a lost passkey:

1. On the 2FA / Passkey Policy screen, click Account Credentials on the toolbar and enter the address in Account.
2. Press Load. The account's passkeys are listed under Credentials; without any, the window reads "No passkeys registered for this account."
3. Remove the lost device's entry with Delete on its row.

The Account Passkey Credentials window

Requirements

Passkeys need a secure connection (HTTPS) and must match the address the browser opened. Outlook and phone mail apps cannot ask for a second step; application-specific passwords are used for them.