# Restricting 2FA to specific groups?

**URL:** https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220
**Category:** Feature
**Created:** [September 7, 2020, 5:33am UTC](https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220 "2020-09-07T05:33:33Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![ghufransyed](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ghufransyed/32/187888_2.png) [@ghufransyed](https://meta.discourse.org/u/ghufransyed)
#### Post date: [September 7, 2020, 5:33am UTC](https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220/1 "2020-09-07T05:33:33Z")

</div>

I have a group where I wish to _require_ 2FA for members of that group, but not require it for non-group-members. Is this possible?

---

<div class="post-metadata">

### Author: ![rishabh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rishabh/32/179446_2.png) [@rishabh](https://meta.discourse.org/u/rishabh)
#### Post date: [September 7, 2020, 5:39am UTC](https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220/2 "2020-09-07T05:39:11Z")

</div>

Hey Ghufran,

An option to enforce 2FA only for the staff group (admins + mods) was added last year on [Requiring 2FA for staff - #18 by jomaxro](https://meta.discourse.org/t/requiring-2fa-for-staff/94868/18). This can be controlled through the `enforce second factor` site setting:

![image](https://global.discourse-cdn.com/meta/original/3X/7/2/72bbba940259c87b56e257cbbd516d8fe1533add.png)

Does this fit your use case?

---

<div class="post-metadata">

### Author: ![ghufransyed](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ghufransyed/32/187888_2.png) [@ghufransyed](https://meta.discourse.org/u/ghufransyed)
#### Post date: [September 7, 2020, 5:59am UTC](https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220/3 "2020-09-07T05:59:45Z")

</div>

I saw that, but I have a third group that are not ‘regular’ members but are not ‘staff’ either. They are more at risk than other members, so this is the group I would like to be able to enforce 2FA without requiring regular members to do the same. Ideally I could enforce 2FA for this group _and_ for staff at the same time.

---

<div class="post-metadata">

### Author: ![ghufransyed](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ghufransyed/32/187888_2.png) [@ghufransyed](https://meta.discourse.org/u/ghufransyed)
#### Post date: [September 7, 2020, 2:31pm UTC](https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220/4 "2020-09-07T14:31:32Z")

</div>

If the “enforce 2nd factor” maps to a single variable in the db, I guess I could just use the rails console or rails db to change it?

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 7, 2020, 2:41pm UTC](https://meta.discourse.org/t/restricting-2fa-to-specific-groups/163220/5 "2020-09-07T14:41:27Z")

</div>

I doubt it, but you could look at the source to see. My guess is that you’d need a plugin.