Two Factor Authentication (2FA) has been part of FormsByAir since 2020. It’s been mandatory for all partner accounts since 2022, and is enforced for every new account we create. Most existing accounts have already enabled it, but a small number created before enforcement was introduced still have it switched off.
To keep every account protected to the same standard, 2FA will become mandatory for all accounts from 1 October 2026.
What’s changing
- Until 1 October 2026, an account administrator can enable 2FA under Profile > Settings > User Authentication Policy. We recommend doing this early so your team can set up at their own pace.
- From 1 October 2026, we’ll enable 2FA automatically on any account that hasn’t already turned it on. As with all accounts, once enabled it can’t be disabled.
What your users will see
If your account doesn’t currently use 2FA, each user will be prompted the next time they sign in:
- A QR code is displayed — scan it with any authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 1Password, etc.)
- Enter the 6-digit code from the app to finish setup
Setup takes less than a minute. After that, users occasionally enter a code when signing in — trusted browsers are remembered for 30 days, so a code isn’t required on every login.
If a user loses access to their authenticator app, an account administrator can use Reset Password for them on the Users page — this also resets their authenticator setup, and they’ll be shown the QR code again the next time they sign in.
Who is not affected
- Accounts that already have 2FA enabled — nothing changes
- People filling in your forms — 2FA applies to portal sign-in only, never to form respondents
- Accounts using private authentication with your own identity provider — your provider’s MFA policy continues to apply
If you have any questions, or need help planning the rollout across your team, contact support@formsbyair.com.