2FA Enforcement

Plan tier

2FA enforcement lives in Team Settings > Security & Privacy, and Vercel's docs don't gate it by plan. It leads the Pro section because enforcement only starts mattering once there's a team to enforce it on.

Two-factor authentication only works if everyone on the team has it on. One person without 2FA is one credential leak away from giving an attacker access to your deployments, your env vars, and your billing. Even if that one person is careful, password reuse is the rule and not the exception. A LinkedIn breach from years ago is enough to give someone a working pair on the Vercel account they barely remember registering.

2FA enforcement removes the choice. Until everyone has 2FA configured, the people without it can't access team resources. CI/CD tokens belonging to non-compliant users stop working. The fix is for those users to add an authenticator app or passkey, after which they're back online and accessible.

For Saturday, you're probably the only person on the team right now. The enforcement is still worth flipping, both because the team will grow, and because forcing yourself to have 2FA configured is exactly the kind of friction you want to set up while there's no pressure.

What is 2FA enforcement?

A team-level policy that requires every member to have two-factor authentication configured before they can access team resources. It doesn't set up 2FA for anyone; it locks out the people who haven't done it yet.

Outcome

Saturday's team has 2FA enforcement enabled, and every member of the team has 2FA configured.

Hands-on exercise 5.1

Three short tasks. The first is preventive (you don't want to lock yourself out), the second is the toggle, the third is the verification.

Requirements:

Open your own Account Settings > Authentication and confirm you have 2FA enabled. Vercel supports authenticator apps (1Password, Authy, etc.) and passkeys (Touch ID, YubiKey, etc.). Either is fine; passkeys are slightly more resistant to phishing.
Open Saturday's Team Settings > Security & Privacy
Scroll to the Two-Factor Authentication Enforcement section
Toggle the switch on and click Save
Open Team Settings > Members. Members without 2FA carry a label saying so, and there's a filter to show members by 2FA status
If anyone carries the label, send them a Slack message asking them to set it up before their next dashboard visit

Implementation hints:

Set up your own 2FA BEFORE flipping the enforcement toggle. Yes, the dashboard warns you about this. Yes, people still skip the warning. Don't be that person.
Passkeys are the slightly better choice if your devices support them. They're phishing-resistant in a way authenticator apps aren't: a passkey only works on the domain it was registered for, so a clever "yourdomain.vercel-login.com" attack can't capture it.
The Members page also shows the role of each member (Owner, Member, Viewer, etc.). RBAC lives in the next lesson, but this is a good moment to glance at the role column and notice anyone who's set to a higher role than their job calls for.
CI/CD tokens belong to specific user accounts. If you have a team member whose token is wired into GitHub Actions, deploying via that account, their token will stop working when their account becomes non-compliant. Fix the 2FA, restart the token, you're back.

Try It

After you enable enforcement, sign out of Vercel and sign back in with an account that has 2FA configured. You should see the standard 2FA prompt:

Two-Factor Authentication
Enter the 6-digit code from your authenticator app
[ • ][ • ][ • ][ • ][ • ][ • ]

If you have a teammate whose account doesn't have 2FA, ask them to try to access Saturday in the dashboard. They should see:

2FA Required
Your team requires two-factor authentication. Configure 2FA on your
account to continue.
[ Set Up 2FA ]

Now open Team Settings > Members. Compliant accounts look normal; the ones without 2FA carry the label:

eve@saturday.example    Owner    Active
jess@saturday.example   Member   2FA not enabled

Anyone with that label is locked out of team resources until they set it up. The filter at the top of the Members list shows members by 2FA status if the team is too big to scan by eye.

Done-When

Your own Account Settings > Authentication shows 2FA enabled (authenticator app or passkey)
Team Settings > Security & Privacy has Two-Factor Authentication Enforcement toggled on and saved
Team Settings > Members shows no member with the missing-2FA label
You can sign in to the team after the change (you didn't lock yourself out)

Troubleshooting

I locked myself out.

The classic. Vercel support can help with account recovery if you can prove ownership of the email. Save the recovery codes from your 2FA setup somewhere safe. They're meant for this exact situation.

A teammate set up 2FA but the Members page still shows the label.

The status updates the next time the dashboard refreshes. Have them log out and back in, then refresh the Members page.

Enforcement isn't actually blocking the teammate.

If the toggle is on and the teammate is still accessing things, they probably had 2FA configured but at a different point in time (Vercel honors existing configurations). Have them verify in their own Account Settings; if it's missing, they need to set it up.

Solution

The state:

Team Settings > Security & Privacy
  Two-Factor Authentication Enforcement:  Enabled

Team Settings > Members
  Missing-2FA labels:  none

No code in the repo for this lesson. The output is a team where the weakest link has been removed.

A note on SAML and Directory Sync: if you're on Enterprise and you use an identity provider for sign-in, you can outsource 2FA to the IdP. That's fine, and in some cases preferable, Okta and Entra ID have their own MFA configurations that may be more rigorous than Vercel's built-in. We cover that flow in Lesson 6.1. Until then, the built-in enforcement is what you want.

Up next: 2FA controls who can sign in. RBAC controls what they can do once they're in.