Description

Ensure multi-factor authentication (MFA) is enforced for every member of the Supabase organization by enabling the Require MFA to access organization setting. With this setting on, members who have not set up MFA on their Supabase account cannot access any project or resource in the organization until they enable it.

Rationale

Supabase dashboard accounts can change database settings, read API keys, and access production data. A stolen or reused password alone should not be enough to take over one of these accounts. Enforcing MFA at the organization level makes sure every member uses a second factor, instead of relying on each person to turn it on for themselves.

Impact

  • All members must use MFA to access the organization

  • Members without MFA lose access until they enable it

  • Personal access tokens are not affected by this setting

Default Value

By default, MFA is not enforced for organization members. Enforcement is available on the Pro, Team, and Enterprise plans.

Pre-Requisites

  • Organization Owner role

  • MFA enabled on the Owner's own account

  • Pro, Team, or Enterprise plan

  • Members told in advance to set up MFA

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Open Organization Settings and select Security.

  4. Verify that Require MFA to access organization is turned on.

  5. If it is off, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Open Organization Settings and select Security.

  4. Turn on Require MFA to access organization.

  5. Tell members without MFA to enable it in their Supabase account settings to regain access.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Open Organization Settings and select Security.

  4. Turn off Require MFA to access organization.

Reference