Admin: Authentication policy
Users enroll authenticator apps, recovery email, and phone. Organization admins set whether 2FA is optional or required, and which OTP channels are allowed. Same split as Google Workspace.
Where to open it
- Sign in as an organization admin.
- Go to /admin.
- Open the General tab → Authentication policy.
User-facing setup is in Security & 2FA. Policy details for both audiences: Authentication policy.
Policy fields
| Setting | What it does |
|---|---|
| 2FA policy | Optional (users choose) or required (password login must enroll an authenticator after the grace period). |
| Apply to | All users, or admins only, when required 2FA is on. |
| Grace period | Days after required 2FA is turned on (or after an admin reset) before login blocks the mailbox. |
| Allowed channels | Authenticator apps, email OTP, SMS OTP. Turning a channel off stops new use of that method. |
| Unusual sign-in | Challenge on a new IP and/or too many distinct IPs in 24 hours, when authenticator 2FA is off. |
What admins cannot do
- Scan a user's authenticator QR or paste TOTP secrets for them.
- See or set the platform SMS API key. That lives in server environment only.
- Force MoovMail OTP on SSO login. SSO uses the company identity provider (enable MFA there).
Admins can reset 2FA from User Management → Password and Login Security if a user is locked out. The user must enroll again. See User management.
SMS OTP
SMS uses SMSGatewayHub at the platform level (sender Moov). The Admin page shows whether the API key is configured. Until operations set MOOVMAIL_SMS_API_KEY on the server, email OTP still works and SMS stays off. Users must verify their mobile number in Settings → Security before they can receive login SMS.
Defaults for new organizations
2FA is optional. Authenticator, email OTP, and SMS OTP are allowed. Unusual-sign-in OTP is on. Required 2FA is off until you turn it on.