Require two-factor authentication for agents

Updated Wednesday, October 28, 2026 · Marc Staine

Require an additional verification step for agent sign-in, after preparing the delivery channels and a practical recovery process. This account setting helps a support team protect access to customer work; it does not configure an identity provider or replace careful role and Division design.

Applies to: Supportbench Core. Location: Settings → Account → Authentication. Requires Administer account policies.

Before you begin

Identify the administrator responsible for sign-in problems during the change. Prepare a representative frontline agent and supervisor so the rollout is tested against real working roles.
Confirm each test agent can access an eligible saved delivery channel. Email delivery requires the login username to be an email address; SMS requires a usable saved mobile number. This page does not edit those profile values.
Plan a fresh sign-in using a browser without existing device trust. Refreshing a signed-in tab does not test the challenge. Keep an authorized administration session available while following your normal change process.

Configure and verify

Open Settings → Account → Authentication and review the current Require two-factor authentication state.
Confirm the intended agents can access their saved verification channels before changing the requirement. Resolve incorrect or inaccessible profile details through the authorized profile-administration process.
Enable Require two-factor authentication and choose Update Authentication. Reopen this page and confirm the saved switch state.
Have the test agent begin a fresh sign-in without existing browser trust. At Verify it’s you, choose Send code by email or Send code by SMS, whichever is offered.
Enter the six-digit Verification code within five minutes and choose Verify and sign in. A successful code is single-use. Verify that the intended agent reaches the expected workspace.
Test an intended alternative delivery channel where available. Record the administrator contact and recovery instructions, then check the other representative role before completing the rollout.

Settings reference

Authentication policy

Setting	What it controls	How to choose
Require two-factor authentication	Requires two-factor authentication under the account authentication policy.	Confirm agents can complete their supported verification process before enabling the requirement.
Sign-in code delivery	Available email/SMS verification uses eligible saved agent profile details.	Confirm a usable delivery channel before rollout; this page does not edit addresses or mobile numbers.
Trusted browser handling	Existing trust can skip another challenge for its supported period.	Test a fresh sign-in without existing trust; do not use an already signed-in tab as the only acceptance test.

Behavior to know

Trust this device for 60 days can prevent a new challenge on an already trusted browser. A successful existing session does not prove the requirement was ignored.
SMS delivery can fall back to the saved email route when the SMS request cannot be accepted. Do not promise that every request selected as SMS arrives by SMS.
Turning the switch off removes the account requirement. It does not establish that all trusted-browser records were revoked or that current sessions ended.
Allow only SSO logins is a separate Account Policies setting. This page does not configure SAML, provider MFA, or the identity provider’s recovery process.

Recommended use

Prepare the people and delivery channels before the account-wide change. This reduces avoidable access interruptions without granting unrelated administrative permissions.
Use a fresh browser context for acceptance and record which channel was tested. Keep passwords, verification codes and recovery details out of shared case notes and screenshots.
Treat unavailable email/SMS access as an identity and profile-recovery task for an authorized administrator. Do not repeatedly toggle the account requirement to troubleshoot one person.

Worked example

A B2B service desk schedules the requirement change before a staffed shift, with a named administrator available for access problems.
A frontline agent and supervisor verify their saved channels. The administrator enables the requirement and confirms the saved state.
Each person performs a fresh sign-in without browser trust, completes the code challenge and confirms access to the intended customer work.
The team documents the tested delivery routes and its recovery contact. It separately verifies any SSO-only policy rather than assuming the 2FA switch configures the identity provider.

Troubleshooting

Problem	What to check
I do not see a new challenge	Check whether the browser is already trusted or the session is already authenticated. Test a fresh sign-in without device trust before concluding the setting failed.
Email is not offered or the code never arrives	Confirm the saved login username is a usable email address, inspect the intended mailbox and filtering, and involve the authorized administrator when the saved identity is wrong.
SMS is unavailable or arrives by email	Check the saved mobile number and the available delivery route. SMS acceptance can fail and use the saved email fallback; check the route indicated by the sign-in screen.
The code is rejected	Use the current six-digit code within five minutes. Start a fresh attempt for an expired code; do not reuse a code already consumed by a successful sign-in.
The agent no longer controls a delivery channel	Follow the organization’s authorized identity/profile recovery process. This account switch is not an editor for email addresses or mobile numbers.
Update Authentication is unavailable	Confirm Administer account policies. A role that can manage agents does not necessarily have authority to change account authentication.

Account → Configure account policies
Organization → Configure agent roles and division access

For additional setup and usage context, see these related guides:

Strengthening Security with Account Authentication in Supportbench

Was this article helpful?