Global MFA Enforcement (Admin Only)

Administrators can mandate MFA for all users on the account. Once enabled, any user without MFA will be prompted to set it up immediately upon their next login and will be restricted from dashboard features until setup is complete.

How To Enforce MFA Site-Wide:

1. Log in to the TNZ Dashboard.
2. Navigate to Account > Account Settings.
3. Find the Enforce MFA toggle.
4. Switch the toggle to ON and click Save.

Individual User Management

If global enforcement is off, admins can still manage MFA requirements for specific users. This is ideal for securing high-privilege accounts while maintaining flexibility for others.

How to Manage a Specific User:

1. Navigate to Users.
2. Select the specific USERNAME.
3. Click on the Dashboard tab.

Available Indicators:

• Enforce MFA (Toggle): When ON, this specific user must use MFA, regardless of the global account settings.
• MFA Enabled? (Status): A "Yes/No" indicator showing if the user has successfully completed their MFA setup.

User Setup Flow (TOTP)

Users can enable MFA voluntarily or as required by an administrator. TNZ uses the standard TOTP protocol.

Setup Steps:

1. Initiate: Click Enable MFA within your profile settings (or follow the prompt at login).

2. Activate: Switch the TOTP MFA toggle to ON.

3. Sync: A QR code and Secret Key will appear. Scan the QR code using an app like Google Authenticator, Microsoft Authenticator, or Authy.

4. Verify: Enter the generated by your app.

5. Backup Codes: The system will provide Backup Codes. Copy and store these in a safe place. These are your only recovery method if you lose access to your mobile device.

Troubleshooting: Lost Devices & Lockouts

If a user loses their device and their backup codes, they will be locked out of the dashboard.

Recovery Process:

1. Contact Your Admin: The user must contact an administrator within their own organisation with Admin rights to the TNZ Dashboard.

2. Admin Support Ticket: The Admin must log in to the TNZ Dashboard and go to Help > Contact Us to submit a reset request. Note: Requests must be made through the Dashboard to verify administrative authority.

3. Re-enrollment: Once TNZ Support resets the MFA, the user can log in and will be prompted to start the setup flow again.

If the sole Administrator is locked out: Please contact TNZ Support directly for identity verification and manual account recovery.