Documentation Index

Fetch the complete documentation index at: https://help.servicetitan.com/llms.txt

Use this file to discover all available pages before exploring further.

Multi-Factor Authentication (MFA)Enforcement for Administrators Home

  • Updated on Aug 28, 2026
  • Published on Apr 29, 2026
  • 10 minute(s) read
Prev Next
Core Product

Multi-Factor Authentication (MFA) Enforcement

Strengthen account security and prevent unauthorized access — setup takes minutes with minimal disruption.

Product overview

See MFA Enforcement in action

Watch the step-by-step TOTP MFA setup experience — from logging in after enforcement to completing authenticator app setup and saving recovery codes.

Setup

ServiceTitan enforces MFA for all administrators and employees with sensitive permissions during the year 2026. We are posting information about each enforcement wave.

Setup checklist

Set granular MFA permissions

Control who has access and who receives security notifications. Limit the Manage MFA permission to a small, trusted group.

Review all impacted users

Use the new Privileged column on the Security screen to identify impacted users, then click Export List on Settings > Security > MFA to review the list outside ServiceTitan. Remove admin access from inactive accounts.

Enable MFA for Identity Services

Configure MFA in ServiceTitan. Start with TOTP only for all impacted users — add SMS later after mobile numbers are verified.

Set up MFA with Google or Microsoft Authenticator App

Ask users to install a TOTP authenticator app in advance. Typical setup takes about 5 minutes.

Enable MFA in Enterprise Hub

Enterprise Hub users are also impacted. Complete MFA setup for Hub administrators before the enforcement date.

Who's impacted

ServiceTitan employees with sensitive permissions and Enterprise Hub users. Employees using SSO with IdP MFA are exempt.

Not a lockout

Users aren't locked out permanently. After a 15-minute reminder they're signed out and guided to complete MFA setup — then continue work immediately.

MFA setup for users during enforcement

Step 1: The user sees the MFA setup reminder — a banner across the top of ServiceTitan with a countdown. They have 15 minutes to finish and save any work in progress.

Step 2: When the countdown ends, a message appears. The user selects OK and is signed out.

Step 3: They go to the login screen and enter their credentials.

Step 4: They are immediately redirected to the authenticator app (TOTP) setup screen.

Step 5: A QR code appears to scan, or a code to enter into the authenticator app of their choice.

Step 6: They enter the 6-digit code from the app.

Step 7: They receive recovery codes and must save them in a secure place.

Step 8: After completing the setup, they continue into ServiceTitan. Typical TOTP setup time is about five minutes.

The MFA setup reminder doesn't appear in every case. Users who already have SMS or an authenticator app set up aren't signed out. Users who sign in through SSO don't see it. Locking a user account signs that user out immediately, with no reminder and no countdown.

Key workflows

Core workflows for preparing, managing, and supporting MFA enforcement across your organization.

Select the right MFA factor for your organization

Select the right MFA factor for your organization

Compare TOTP Authenticator App vs. SMS MFA to choose the best fit.

TOTP Authenticator App

Pros

Fast login experience
No phone number required
Works offline and internationally
Stronger security than SMS
Desktop authenticator options available

Cons

Requires installing an authenticator app (Google/Microsoft Authenticator, Okta Verify, or Duo)

SMS MFA

Pros

No app required
Familiar and fast setup

Cons

Requires a verified mobile number
Shared devices not supported
If a phone number changes after MFA is set up, administrators with the Manage MFA permission receive a security notification.
Higher lockout risk if numbers are outdated
Delivery varies internationally
Requires a password reset for initial setup

Tip: Start TOTP only for all impacted users. Add SMS later after mobile numbers are verified.

Prepare your organization for enforcement

Prepare your organizations for enforcement

Role validation, permissions cleanup, contact prep, internal readiness, and communications.

Role and access validation

Review all employees with roles containing sensitive permissions
Remove administrator access from inactive or irrelevant accounts
Ask your CSM for a list of impacted employees
Use the new Privileged column on the Security screen to identify impacted users before enforcement
Go to Settings > Security > MFA and click Export List to download the current view as a CSV. The export reflects your active filters, search, and sort, so filter to MFA Disabled first if you want a gap list. See Export the MFA user list

Permissions cleanup

Limit the Manage MFA permission to a small group of trusted administrators
These administrators receive security notifications — e.g., mobile number changes after MFA is enforced for SMS
Set granular MFA permissions in ServiceTitan to control who has access and who receives notifications

Contact and device preparation

Clean up employee profiles by adding and verifying mobile numbers (if supporting SMS)
Inform users that SMS requires a valid mobile number and that changes trigger security alerts to administrators with the Manage MFA permission
Decide which authenticator apps to recommend and ask users to install in advance

Internal readiness

Establish an internal MFA support team

Identify one to three administrators to answer questions, reset or unlock accounts, and monitor alerts
Restrict the Manage MFA permission to this small group
These administrators receive security notifications, such as when a mobile number changes after SMS MFA setup
If you plan to use SMS for some users, advise these administrators to set up an email filter to automatically organize or flag mobile-number-change notifications

Prepare support availability for wave rollouts

Plan for the highest support activity in the hours immediately after each enforcement wave starts
Ensure at least one MFA support administrator is available during each wave
Notify your CSM of your enforcement schedule so they can coordinate support if needed

Communicate expectations clearly

Notify users at least 72 hours before their enforcement wave
Tell them they'll see a 15-minute countdown reminder before being signed out, and that they'll set up MFA the next time they sign in
Provide links to recommended authenticator apps
Clarify when enforcement will occur and who to contact with MFA questions to reduce help desk tickets
Use the MFA Communication templates to notify your users of the upcoming enforcement (optional)

Prepare for edge cases

Dual-role users, such as Administrator + Technician or Administrator + Employee, may need extra guidance
MFA is tied to the individual, not the device
SSO employees with IdP MFA aren't impacted by enforcement
Users with unmonitored inboxes may miss important MFA communications. Confirm that their email addresses are current and monitored

Leadership, IT, and security alignment

Notify IT and Security teams of MFA wave timing
Confirm who is responsible for supporting users during MFA setup
Discuss whether administrator rollout will act as a pilot for later expansion to other roles (optional)

Prepare internal materials and quick guides

Links to recommended authenticator apps
Steps for TOTP setup
How to store and use recovery codes
How to reach your internal support
What to expect immediately after logout and after successful setup

Enforcement process

Enforcement process

What to expect during enforcement, tools for Manage MFA admins, and escalation paths.

What happens during enforcement

Users without MFA configured are logged out when enforcement begins for their cohort. They first see the MFA setup reminder — a banner with a 15-minute countdown — so they can save their work before the session ends.
SMS becomes available when enforcement begins
When they sign back in, they are directed to the authenticator app (TOTP) setup flow — this is not a lockout
SSO accounts with IdP MFA enabled are exempt from ServiceTitan's enforcement

Users with existing MFA

If a user already set up TOTP or SMS, enforcement does not interrupt their session
If both TOTP and SMS are configured, the employee can choose their preferred factor at login

Who is included versus excluded

Included: Administrators and employees with sensitive permissions
Excluded: Employees not holding sensitive permissions and technicians

Tools for administrators with Manage MFA permission

Reset TOTP MFA — clears TOTP configuration and forces the employee to set up from scratch
Disable MFA (SMS, TOTP, or both) — use sparingly for temporary exception scenarios
Lock or unlock an account — pause access during a breach investigation or long-term absence
View MFA status — confirm which users are pending, completed, or unconfigured
Troubleshoot MFA errors — use the Audit Trail to investigate failed login attempts and account changes

Export the MFA user list — this one does not require Manage MFA. Anyone with the View MFA permission can go to Settings > Security > MFA and click Export List to download the current view as a CSV, for tracking readiness or reporting on MFA status. See Export the MFA user list.

What to expect during enforcement

Employees will reach out after being logged out. Prepare your internal support team for questions like:

Why did I get logged out?
Which authenticator app should I use?
What if I don't want to use TOTP? Is there another option?

Step 1: Share resources — Provide a short list of recommended apps (Google Authenticator, Microsoft Authenticator, or Authy) and clear instructions for downloading on iOS and Android.

Step 2: Support MFA resets — Resetting MFA forces a new login and a new setup. Ensure at least one administrator with the Manage MFA permission is available during early enforcement hours.

Step 3: Expect increased support activity — After each enforcement wave, your internal support team and CSM should remain on standby. Consider scheduling extra coverage around your assigned enforcement window.

Step 4: Address SSO confusion — Some users may not realize MFA is enforced at their IdP, not in ServiceTitan. Reminder: If you authenticate through SSO and MFA is enforced at your IdP, you will not see the ServiceTitan MFA screen.

Escalation paths

Internal path: Employee → Internal MFA Support Administrator → Reset or disable MFA as needed. Only escalate to ServiceTitan CSM/Support if the reset flow cannot resolve the issue.
Escalate to your CSM if multiple employees can't authenticate, there's an SSO discrepancy, or you need feature-gate changes
Contact ServiceTitan Support for MFA loops, high-volume failures, suspected account compromise, or inability to reset MFA

Email templates

Email templates

Ready-to-use templates to notify your users of upcoming MFA enforcement.

Troubleshooting & FAQ

Quick solutions to common issues and answers to frequently asked questions.

Troubleshooting

Step-by-step guides to resolve the most common issues.

Frequently Asked Questions

Check out the most frequently asked questions for the MFA enforcement process.

Will users be locked out if they don't set up MFA before enforcement?

No. They'll be logged out and guided to complete MFA. They can continue when setup is completed.

Will users get a warning before they're signed out?

Yes. Affected users see the MFA setup reminder — a banner across the top of ServiceTitan with a 15-minute countdown — before their session ends. They can keep working and save what's in progress during that window. When the countdown ends, a message appears; selecting OK ends the session. At their next sign-in, they set up an authenticator app or SMS verification.

Users who already have a verification method set up aren't signed out. Users who sign in through SSO don't see the reminder. Locking a user account signs that user out immediately, with no reminder.

How long does an MFA setup take?

TOTP setup takes about 5 minutes to download an authenticator and set up your account. SMS requires receiving a code and entering it.

Do we need to enable both SMS and TOTP?

No. TOTP is the only required factor for Winter 2025 Release (ST-76). SMS can be enabled later. If you select to enable both factors, employees can select the authentication factor of their choice.

What if a user loses their device?

They can use recovery codes or ask an administrator with the Manage MFA permission to reset MFA for them.

What if our SSO already enforces MFA?

If MFA is enforced by the IdP, those users are not impacted by enforcement.

What if a phone number changes after SMS is enabled?

Administrators with the Manage MFA permission receive an alert as a security measure.

Can employees self-enable MFA?

Administrators with the Manage MFA permission can enable MFA for an employee. The employee must set up their MFA upon enablement.

Can employees select between SMS and TOTP?

Yes, but during enforcement, only TOTP is required. If both are enabled, employees can select either at login.

Can we test ahead of time?

Yes, use the ServiceTitan Practice or Next environments to test MFA setup safely.

Can you turn off the MFA Phone Number Change email?

This security protocol is essential to prevent account takeovers by ensuring administrators are alerted to any changes. To manage the volume of notifications, we advise limiting the Administrator permission for MFA control to a small number of people. We recommend that those administrators responsible for MFA use an email filter to effectively manage these notifications.

Documentation

Use these articles and videos to train your team and support your rollout.

Related articles