Setting Up Two-Factor Authentication in Momos

Two-Factor Authentication (2FA) adds a second check when you sign in to Momos: after your password, you enter a 6-digit code from an authenticator app on your phone.

TABLE OF CONTENTS

• What is Two-Factor Authentication?
• Who is required to use 2FA
• What happens at your next sign-in
• Setting up 2FA as an individual user
• Managing 2FA for your team (admins only)
• Troubleshooting

What is Two-Factor Authentication?

2FA verifies your identity in two ways: your password, and a one-time code generated by an authenticator app on your phone. Momos supports authenticator apps such as Google Authenticator, Microsoft Authenticator and Authy.

Email-based 2FA codes have been retired. An authenticator app is now the only supported method.

Who is required to use 2FA

Whether you must use 2FA depends on your user role. If you hold more than one role, the strictest requirement applies.

The requirement updates automatically when a role's permissions change. For example, if an admin gives a role Manager access to Campaigns, everyone in that role must set up 2FA at their next sign-in.

If your account previously had "Enforce 2FA for all organization members" turned on, all your other roles started as Required. Otherwise they started as Optional.

Who is exempt

• Users who sign in with single sign-on (SSO), such as Okta. Your company's identity provider handles 2FA, so Momos won't prompt you. Users in the same account who sign in with a password still follow their role's requirement.

To check your role and permissions, see Understanding User Roles.

What happens at your next sign-in

If your role requires 2FA and you haven't set up an authenticator app, Momos asks you to set one up the next time you sign in. There is no grace period, and you can't continue into Momos until setup is complete.

Before you start, install an authenticator app on your phone:

The setup takes three steps:

1. Configure. Scan the QR code with your authenticator app, or type in the setup key. The banner at the top tells you why 2FA is required, for example "Your role, Brand Marketing, requires two-factor authentication."
2. Confirm. Enter the 6-digit code shown in your authenticator app.
3. Save your recovery code. Momos gives you one recovery code. Store it somewhere safe, such as a password manager. You'll need it to sign in if you lose access to your phone.

If you don't want to set up 2FA right now, choose Sign out. You'll be asked again the next time you sign in.

Once 2FA is set up, each sign-in asks for your password and then a 6-digit code from your app.

Users required to use 2FA can't turn it off. You can reset and set up your authenticator app again from My Security Settings, but you can't remove it while your role requires 2FA.

Setting up 2FA as an individual user

If your role doesn't require 2FA, you can still turn it on yourself, and we recommend it. Go to My Security Settings and follow the same three steps: configure your app, confirm the code, and save your recovery code.

From My Security Settings you can also:

• Regenerate your recovery code. Your old code stops working as soon as a new one is created.
• Reset your authenticator app, for example when you move to a new phone.
• Remove 2FA, only if your role doesn't require it.

For a full step-by-step walkthrough, follow the guide below:

Managing 2FA for your team (admins only)

Admins manage 2FA by role in Settings > Two-Factor Authentication. The old account-wide "Enforce 2FA for all organization members" toggle has been replaced by per-role settings.

Role table

Each role shows its member count, its 2FA requirement and how many members have set up an authenticator app (for example, 8/12). The requirement column shows one of three states:

• Required (Admin): locked, can't be changed.
• Required (contains: Offers, Campaigns…): locked because the role has Manager access to a sensitive module. To unlock it, remove that access in the role's permissions.
• Required / Optional toggle: you choose.

When you edit a role's permissions in a way that makes it newly required, Momos shows a confirmation with how many members haven't set up an authenticator app yet. They'll be asked to set it up at their next sign-in.

If you remove a role's sensitive-module access, the role stays Required by default. You can then switch it to Optional. Members of a role that moves to Optional keep their authenticator app and can choose to remove it.

Members table

The members table lists each user's role, whether 2FA is required and why (Admin, role policy, or Okta exempt), and whether they've set up an authenticator app. Use the Required, not set up filter to find users who will be prompted at their next sign-in.

Resetting a member's authenticator app

If a member loses their phone and their recovery code, reset their authenticator app from the members table. If their role requires 2FA, they'll set it up again at their next sign-in.

If you are the only admin and you're locked out, contact Momos Support. We'll verify your identity before resetting your 2FA.

Audit log

The 2FA audit log records who did what and when, including:

• Role requirement changes (Required ↔ Optional)
• Roles that became required or unlocked because of a permission change
• Authenticator apps set up, reset by an admin, or removed by a user
• Recovery codes regenerated or used to sign in

For a full step-by-step walkthrough, follow the guide below:

Troubleshooting

Why am I being asked to set up 2FA now?

Your role requires it. You're either an admin, your role has Manager access to a sensitive module, or your admin has set your role to Required. The setup banner names the reason.

I'm being asked to set up 2FA but I already had it enabled.

If you previously used email-based 2FA, you'll need to switch to an authenticator app. Email codes are no longer supported.

I was asked to set a new password when I signed in.

When role-based 2FA launched, passwords were reset for admins and users in required roles. Set a new password, then complete 2FA setup.

I'm setting up 2FA on my phone and can't scan the QR code.

You can't scan a QR code shown on the same phone. Copy the setup key instead and paste it into your authenticator app.

I lost my phone.

On the sign-in screen, choose Use a recovery code and enter the code you saved during setup. If you don't have it, ask your admin to reset your authenticator app. You'll set it up again at your next sign-in.

I'm an admin and I'm locked out.

Ask another admin on your account to reset your authenticator app. If you're the only admin, submit a ticket and we'll verify your identity before resetting it.

I sign in with Okta. Do I need Momos 2FA?

No. Your identity provider handles 2FA, and Momos won't prompt you.

I want to turn off 2FA but there's no option to remove it.

Your role requires 2FA, so it can't be removed. Ask your admin if you think your role is set incorrectly.