Security settings
Enforce two-factor authentication organisation-wide for your team — a central switch that forces all users to set up 2FA at their next login.
→ Open security settings in SimpliServ
Under Administration → Organisation → Security you set organisation-wide access requirements for your whole team. Currently you control here, centrally, whether two-factor authentication (2FA) is mandatory for all users.
The page manages one organisation-wide setting: the 2FA requirement. Turning your own 2FA on and off, by contrast, you do in your personal profile. How you set up your second factor there and get your recovery codes is in 2FA.
Access and permissions
The security settings are part of organisation management and only visible to authorized accounts:
- Viewing requires the
admin.settings.viewpermission. Without it you see, instead of the settings, a note that you lack the permission to view this content. - Saving additionally requires
admin.settings.update. Without it you can see the toggle but not change it – the field and the Save button stay disabled.
Which role gets these permissions is controlled under Users & roles.
Enforce two-factor authentication
In the Security area you'll find the Two-factor authentication card with a single toggle:
- Enforce two-factor authentication – requires all users to enable 2FA before they can access the workspace.
Open the security area
In the navigation, go to Administration → Organisation and open the Security area.
Enable the 2FA requirement
Turn on Enforce two-factor authentication and click Save. SimpliServ confirms with "Security settings saved."
Effect at the next login
From now on, all members who haven't set up 2FA yet are automatically taken to 2FA setup at their next login. Only after completed setup can they work normally again.
As long as the requirement is active and a user hasn't confirmed a second factor yet, SimpliServ blocks access to all protected pages and takes them back to setup. Make sure your team has an authenticator app ready before you enable the option for everyone.
How the requirement works technically
When the 2FA requirement is active, SimpliServ checks at every login and every request whether the user already has a confirmed second factor stored:
- At login: if the user has no 2FA yet, they aren't logged in directly but redirected to setup. If they already have 2FA active, the normal 2FA-code prompt follows as usual.
- During the session: without a confirmed second factor, protected pages are locked and the user lands back on the profile or setup page. Only login, logout and the 2FA and email-verification routes themselves are exempt, so setup can be completed at all.
- API keys are exempt: machine access via API keys (e.g. integrations) can't go through an interactive 2FA process and isn't blocked by the requirement.
What this page doesn't cover
Beyond the 2FA requirement, there are deliberately no further switches here:
- Session/timeout settings, password policies, IP or domain allowlists aren't currently part of this page.
- Platform-side safeguards – tenant separation, encrypted backups, hosting location and the deployment pipeline – are described in Security and are operated centrally by SimpliServ.
Set up 2FA
How individual users set up their second factor and their recovery codes.
Platform security
An overview of architecture, data separation, backups and hosting.
Users & roles
Assign permissions like admin.settings.update to roles.
API access & external apps
Issue API keys that are exempt from the 2FA requirement.
How is this guide?
Inventory management & storage
Central inventory settings: the default warehouse for stock postings, create warehouses and locations, configure reorder notifications and keep an eye on the account's file storage
Integrations
Connect external systems like Shopify, Wix, JTL-Wawi, WordPress and FinanzOnline