# Ensure all workspace members have two-factor authentication enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876660103732-ensure-all-workspace-members-have-two-factor-authentication-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every member of the Render workspace has turned on two-factor authentication (2FA) for their Render account. With 2FA, signing in requires a one-time code in addition to the password, so a stolen password alone is not enough to access the workspace.

**Rationale**

Render accounts can deploy code, read environment variables and secrets, open shells on running services, and delete databases. If a member's password is phished or reused from another breach, an attacker could take over the account and the workspace resources it can reach. 2FA blocks most of these account takeovers.

**Impact**

-   Stolen passwords alone cannot be used to sign in
    
-   Protects deploy access, secrets, and databases
    
-   Each member must set up an authenticator app
    

**Default Value**

By default, 2FA is turned off for each Render account and is enabled by each user from their own Account Settings.

**Pre-Requisites**

-   Workspace Admin role to review members
    
-   Each member's cooperation to enable 2FA on their own account
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  Check whether two-factor authentication is enforced for the workspace. If it is, every member who can access the workspace has 2FA enabled.
    
4.  If 2FA is not enforced, ask each member listed in the Team members section to confirm in Account Settings > Account Security that two-factor authentication is on.
    
5.  If any member does not have 2FA enabled, follow the implementation steps.
    

**Implementation Steps**

1.  Ask each member without 2FA to sign in to the Render Dashboard.
    
2.  The member opens Account Settings (dashboard.render.com/u/settings) and goes to the Account Security section.
    
3.  The member toggles on two-factor authentication and completes setup with an authenticator app.
    
4.  To make this mandatory for everyone, also enforce 2FA for the workspace (see the next check).
    

**Backout Plan**

1.  A member can turn off two-factor authentication from Account Settings > Account Security. Note that this will block them from the workspace if 2FA is enforced.
    

**Reference**

-   [https://render.com/docs/login-settings](https://render.com/docs/login-settings)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.