2FA

[Soli]

Hi

I'm looking for a way to configure our security settings so that regular users or even Managers or system administrators cannot disable Two-Factor Authentication (2FA) on their own, or have it disabled for them by anyone other than a System Owner

Currently, it seems that even with Manager roe with lower privilege levels might have the ability to turn off 2FA, which creates a potential security risk for our organization.

• Goal: Ensure that disabling 2FA requires explicit authorization/action exclusively by a System Owner.
• Question: Is there a built-in policy, role-based access control (RBAC) setting, or workaround to enforce this restriction?

Any advice, configuration steps, or pointers to documentation would be greatly appreciated. Thanks in advance!

 

[Alphabetic]

This will be role based, if they can edit the user they can modify 2FA. Users cant turn off their own.

 

[Soli]

I want as system owner to disable the option to every Manager etc. to disable the 2FA it's creating security issues

 

[Evolute IT]

I want as system owner to disable the option to every Manager etc. to disable the 2FA it's creating security issues

As @Alphabetic said, there's no settings for this. If a user has the right to edit users, then they can disable 2FA for those users.

I suggest you simply don't use those roles.

 

[Alphabetic]

Possible solution...

Admin IP Console Restrictions. If its on the LAN, be more specific.