# Ensure MFA is enabled for organization members

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103899050191-ensure-mfa-is-enabled-for-organization-members
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure multi-factor authentication (MFA) is enforced for every member of the Supabase organization by enabling the Require MFA to access organization setting. With this setting on, members who have not set up MFA on their Supabase account cannot access any project or resource in the organization until they enable it.

**Rationale**

Supabase dashboard accounts can change database settings, read API keys, and access production data. A stolen or reused password alone should not be enough to take over one of these accounts. Enforcing MFA at the organization level makes sure every member uses a second factor, instead of relying on each person to turn it on for themselves.

**Impact**

-   All members must use MFA to access the organization
    
-   Members without MFA lose access until they enable it
    
-   Personal access tokens are not affected by this setting
    

**Default Value**

By default, MFA is not enforced for organization members. Enforcement is available on the Pro, Team, and Enterprise plans.

**Pre-Requisites**

-   Organization Owner role
    
-   MFA enabled on the Owner's own account
    
-   Pro, Team, or Enterprise plan
    
-   Members told in advance to set up MFA
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your organization.
    
3.  Open Organization Settings and select Security.
    
4.  Verify that Require MFA to access organization is turned on.
    
5.  If it is off, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your organization.
    
3.  Open Organization Settings and select Security.
    
4.  Turn on Require MFA to access organization.
    
5.  Tell members without MFA to enable it in their Supabase account settings to regain access.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your organization.
    
3.  Open Organization Settings and select Security.
    
4.  Turn off Require MFA to access organization.
    

**Reference**

-   [https://supabase.com/docs/guides/platform/mfa/org-mfa-enforcement](https://supabase.com/docs/guides/platform/mfa/org-mfa-enforcement)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.