Skip to content

Authentication

For administrators. Organisation-wide rules for how users sign in to the Tarot Routing platform.

Open Admin panel → Organisation Settings → Authentication. It has two tabs:

  • Password Policy: the length and character rules for passwords. See Password Policy.
  • Require MFA: whether every user in your organisation must use Multi-Factor Authentication.

Each user manages their own passkeys, authenticator apps, password and email sign-in from their Authentication Settings.

Require MFA

With Require MFA on, a password alone or an email alone is no longer enough for anyone in your organisation. Every user must sign in with a passkey, or with two different factors such as a password followed by an authenticator app code.

To change it, turn the Require MFA switch on or off. You need a Role with write access to Organisation Settings.

What happens when you turn it on

  • Nobody is signed out. Users who are signed in stay signed in, and MFA applies the next time each of them signs in.
  • Users without MFA set up are asked to set it up. At their next sign-in, after their password, Tarot shows Your account requires a second factor or a passkey before you can continue. They can't reach the platform until they add a passkey, an authenticator app or email sign-in.
  • Users can't opt out. In their Authentication Settings, the MFA switch shows Required by organisation and is locked on. They also can't remove their last second factor without adding a replacement first.
  • New users set up MFA when they accept their invitation. The setup screen won't let them finish with a password alone.
  • Driver App run sheets are unaffected. Drivers load runs with a run sheet, not a user sign-in, so Require MFA doesn't change anything for them.
  • Planner Login in the Driver App stops working. It signs in with an email and password only for now, so users in an organisation that requires MFA can't use it until the Driver App update that adds MFA and passkeys.

What happens when you turn it off

Turning Require MFA off doesn't remove any passkeys or authenticator apps, and doesn't turn MFA off for anyone. Users who already have MFA keep it until they turn it off themselves.

Before you require MFA

  1. Tell your users first. Explain that they'll be asked to set up a second step at their next sign-in. If any of them use Planner Login in the Driver App, see the note above before you switch it on.
  2. Recommend passkeys. A passkey covers both factors in one step, so it's the least extra work for planners who sign in every day. Point them to Add a passkey.
  3. Ask people to set up two methods, for example a passkey on their computer and an authenticator app on their phone. There are no recovery codes, so a second method is what saves them when a device is lost.
  4. Check who can reset sign-in methods. If a user loses every method, an administrator with write access to Users must reset their sign-in methods. Make sure more than one person in your organisation can do this, because nobody can reset their own.