Require two-factor authentication for everyone in your Meta business portfolio

What to do first

Check who has access. Open the people list in your business settings and remove anyone who doesn’t need it. Then tell your team the change is coming and why, because anyone without two-factor authentication on their own account will be asked to set it up when they next log in.

Step 1: Confirm you can change it

Only people with full control of the business portfolio can change this setting. If you can’t see it, you may have partial access. Ask a full-control admin, or see our guide on lost admin access.

Step 2: Turn it on

In Business Suite open Settings, go to Business portfolio info, then Business options, and set Two-factor authentication to Everyone. Save the change.

Step 3: Help your team set it up

Recommend an authentication app. Each person sets it up in their own account’s security settings. Make sure they save recovery codes in a safe place. For people without a smartphone, a security key is an alternative.

Step 4: Review your Security Center

Meta’s Security Center for businesses collects recommended protections. Look at it after the change to see what else is worth turning on, such as reviewing admin roles and ad account access.

A simple rollout plan

1. Remove inactive people from the portfolio.
2. Send the team a short message explaining the change, the date and what to prepare.
3. Ask everyone to set up an authentication app and save recovery codes before the date.
4. Switch the setting on.
5. Check the people list a few days later to see who hasn’t completed setup and help them.

For contractors, include a note in their onboarding. For people who share a workstation, agree on how they’ll handle codes without sharing a single device.

What not to do

• Don’t make everyone an admin to “avoid hassle.” Give each person the lowest role they need.
• Don’t share one login across the team.
• Don’t turn it on during a campaign launch without warning, since team members may be briefly locked out.

Keeping it effective

Review the list of people each quarter, remove leavers the same day and keep at least two trusted full-control admins. Add a line about two-factor authentication to your onboarding checklist for contractors.