Enabling two-factor authentication (2FA) is a global setting. Once activated, it applies to all users within your Day Off company. However, administrators can disable it for specific users individually from their employee profile.
How to Set Up Two-Factor Authentication
Log in to your Day Off account using your administrator credentials.
In the left-hand menu, go to Settings & integrations → Security.
Locate and click on the Two-Factor Authentication card.
Click the Toggle Switch to turn the feature ON.
A confirmation dialogue will appear warning you about user logouts. Click Confirm to finalize the activation.
Important Note: The moment you confirm this setting, all active users (including yourself) will be instantly logged out of Day Off. This is a security measure to ensure everyone sets up their secondary authentication method upon their next login.
What happens next?
1. Forced Session Logout
Every team member currently active in the application will be logged out of their session. They will be redirected to the main login screen.
2. Mandatory 2FA Setup on Next Login
When users attempt to log back in with their standard email and password, Day Off will halt the login process and prompt them to configure their 2FA.
The Setup Process: Users will be presented with a setup screen (typically displaying a QR code). They will need an authenticator app (such as Google Authenticator, Microsoft Authenticator, or 1Password) on their mobile device to scan the code and link their account.
Verification: After scanning, they must enter the temporary 6-digit verification code generated by their app to complete the setup.
3. Subsequent Logins
For all future logins, after entering their password, users will simply be prompted to enter the rotating 6-digit verification code from their mobile authenticator app to grant them access to Day Off.
Why 2FA Matters for Your Team
A password alone can be guessed, reused, or stolen. With 2FA, someone also needs the code from the user’s phone to sign in. This extra step makes it much harder for an attacker to reach leave records and employee data. You can learn more about this approach in the overview of multi-factor authentication.
Before you turn it on, let your team know what to expect. Ask everyone to install an authenticator app in advance, so the first login goes smoothly. If your company prefers signing in through a central account, you can also read how to enable single sign-on.