This improvement enforces multi-factor authentication (MFA) for administrator roles who haven’t yet enabled MFA to prevent account takeovers and protect sensitive data.
What’s changing with MFA Enforcement for Enterprise Hub Administrators?
Before, MFA was optional for Enterprise Hub (EH) administrators. That left accounts with elevated access exposed to greater risk if credentials were compromised. Now, if the MFA Enforcement Policy feature is set to Enforced for Admins, all Enterprise Hub administrators must have MFA factor setup: SMS or TOTP. If the administrator does not have an MFA factor setup, they will be prompted to set up TOTP.
Before and After
Before (Current)
An EH administrator signs in with only a username and password.
MFA is optional and not required for high-access roles.
A security breach using stolen credentials could allow access to admin functions.
No enforcement of TOTP or second-factor authentication.
Impact: Administrator accounts are at higher risk of unauthorized access.
After
Administrator logs in. If MFA is already configured, the administrator is directed to the Enterprise Hub Modules screen.
If MFA is not configured, the administrator follows the TOTP MFA enrollment process.
MFA setup is mandatory and enforced as part of the standard login workflow.
Impact: EH Administrator accounts are secured against credential-based takeovers.
Who uses this feature
All business ty pes
Administrators
Employees with the Edit user, Create new user, Manage Roles, or Manage MFA permissions
An Enterprise Hub administrator is any user who has access to the User Management module.
Region availability: All regions
How it works for your industry
A Business Owner with sensitive permissions in Enterprise Hub must complete TOTP MFA to proceed, ensuring only verified administrators modify enterprise-level settings.
How to Prepare
Confirm which administrator accounts exist in your tenant.
Identify any administrators not currently using SMS or TOTP MFA.
Train your operations to manage MFA onboarding steps.
Align internal security policies with the enforced MFA requirement.