# Ensure Two-Factor Authentication Is Enabled on the OVHcloud Account

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826021663886-ensure-two-factor-authentication-is-enabled-on-the-ovhcloud-account
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure two-factor authentication (2FA) is enabled on the OVHcloud account, using at least one method such as a mobile authenticator app, a security key, or SMS. With 2FA enabled, signing in to the Control Panel requires a one-time code or key in addition to the password.

**Rationale**

The OVHcloud account controls every service, invoice, and resource it owns, so a stolen password alone could give an attacker full control. Two-factor authentication blocks sign-in with only a password, which protects the account against phishing, password reuse, and leaked credentials.

**Impact**

-   Signing in requires a second factor in addition to the password
    
-   Protects all services in the account from password theft
    
-   Users must keep their 2FA device and backup codes safe
    

**Default Value**

By default, two-factor authentication is not enabled on an OVHcloud account.

**Pre-Requisites**

-   Access to the OVHcloud account owner login
    
-   A mobile authenticator app, a security key, or a phone number for SMS
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).
    
3.  Check the Two-factor authentication section and verify that at least one method is enabled.
    
4.  If no method is enabled, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).
    
3.  On the Account security page, click Enable two-factor authentication.
    
4.  Choose a method (Mobile App, Security Key, or SMS) and follow the steps to link your device.
    
5.  Save the 10 single-use backup codes shown on screen in a secure place, such as a password manager.
    
6.  Optionally add a second method so you can still sign in if one device is lost.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).
    
3.  Delete the enabled two-factor devices, and disable the backup codes, entering a backup code to confirm. Two-factor authentication is fully disabled only when all devices and backup codes are removed.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-account-enable-2fa?id=kb\_article\_view&sysparm\_article=KB0043079](https://help.ovhcloud.com/csm/en-account-enable-2fa?id=kb_article_view&sysparm_article=KB0043079)
    
-   [https://docs.ovhcloud.com/en/guides/account-and-service-management/account-information/new-control-panel-navigation](https://docs.ovhcloud.com/en/guides/account-and-service-management/account-information/new-control-panel-navigation)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.