Secure the organisation
Require two-factor authentication from every member and limit dashboard access to certain IP addresses, in Settings › Organization security.
Two rules protect the whole organisation: every member confirms their sign-ins with a second step, and the dashboard only opens from the IP addresses you allow. Two-factor authentication on your own account is set separately, in Secure your sign-in.
The owner, an Administrator, a Developer, a Viewer or a custom role with View settings reads these rules. Only the owner, an Administrator or a custom role with Manage settings changes them, and saving asks for the security code. The rules apply in Sandbox as in Live.
Require two-factor authentication
Step 1, Open organisation security
Open Settings, then Organization security in the Organization group.
Both rules are saved together, with the security code. Step 2, Turn the rule on
Under Two-factor authentication policy, turn on Require two-factor authentication for all members.
Step 3, Save
Save changes, in the bar at the bottom of the screen, asks for the security code and then applies the rule.
The rule applies as soon as it is saved. A member who does not have two-factor authentication yet lands, at their next action, on Set up two-factor authentication, and cannot open anything in the organisation until they choose a method: Authenticator app, Code by email, Passkey or, if they have a verified phone number, Code by text message. A member already signed in without having passed their second step is signed out and signs back in with it.
Trust this device for 30 days, which a member can tick when entering their code at sign-in, lets that browser skip the second step for 30 days. An organisation that requires two-factor authentication does not accept it: its members go through the second step at every sign-in.
Restrict IP addresses
Step 1, Add your own address
Under Dashboard IP whitelist, the page shows your current IP address. Add my IP address puts it in the list. Until it is there, the page warns you that you would lose access and refuses to save.
Step 2, Add the other addresses
In IP address or range, type an IPv4 or IPv6 address, or a range such as 10.0.0.0/24, then click Add. Repeat for each office or network.
Step 3, Save the list
Save changes asks for the security code and then applies the list.
An empty list, marked No IP restrictions, lets the dashboard open from anywhere. A member who signs in from another address lands on Access denied: they can Switch to another organization, open their Personal settings or Sign out, and ask an Administrator to add their address. The list only covers the dashboard: it does not limit calls made with your API keys. An API key has its own list of allowed addresses, see Environments & API keys.