> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thepublive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-Factor Authentication (MFA)

> Enable and enforce MFA for dashboard users to require OTP verification on login

MFA adds a second verification step to the Publive dashboard login. When enabled, users must enter a 6-digit OTP, received on their registered email address, after their password before they can access the dashboard.

<Note>
  **Effective August 2026, MFA enforcement is live for every user on every publisher account.** This is no longer opt-in — see [Why MFA Is Now Enforced](/dxp/documentation/getting-started/mfa/why-mfa-is-enforced) to learn more.
</Note>

## Enabling MFA

MFA can be configured in two ways:

**Per user** — Open the user's profile via **Team Members → Edit**. Toggle MFA on for that individual. The user will be required to verify via OTP on their next login.

**Globally for all users** — In publisher settings, enable the **Enforce MFA** option. This applies MFA to every user under that publisher immediately.

<Warning>
  Enabling MFA — whether for an individual or globally — immediately signs out all affected users.
</Warning>

## OTP mechanics

| Detail             | Value      |
| ------------------ | ---------- |
| Code length        | 6 digits   |
| Code validity      | 5 minutes  |
| Max wrong attempts | 5          |
| Lockout duration   | 15 minutes |

After 5 incorrect OTP attempts the account is locked for 15 minutes before another attempt can be made.

## Admin password override

Publishers Admins, Super Admins, and any custom role with the **Manage Members** permission can set a new password for any team member directly from the dashboard — without needing the member's current password.

**Where to find it:** Go to **Team Members → Edit** for the relevant member. Scroll to the **Security** section and click **Manage Password** to expand the form.

**How it works:**

1. Enter the new password and confirm it.
2. A confirmation dialog shows the member's name and what will happen — click **Confirm** to proceed.
3. On success, the member receives an email notifying them their password was changed by an admin.
4. The member's existing sessions remain active, but they must use the new password on their next login.

<Note>
  The Security section is only visible to members who have the Manage Members permission. It is not rendered for other roles.
</Note>