> ## Documentation Index
> Fetch the complete documentation index at: https://cogno.studio/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure your workspace

> Set up two-step verification, require MFA for every workspace member, and review the audit log of privileged actions.

Protect your account with two-step verification, make it mandatory for everyone in a Business workspace, and review who exercised privileged permissions in the audit log.

## Prerequisites

* An authenticator app (Google Authenticator, 1Password, or similar) for two-step verification.
* A **Business** workspace and an admin or Owner role to require MFA workspace-wide.
* An admin or Owner role to read the audit log.

## Set up two-step verification

Two-step verification is per account and applies wherever you sign in.

<Steps>
  <Step title="Open your account security settings">
    Open **Settings → Account** and find the **Security** section with the **Two-step verification** row.
  </Step>

  <Step title="Enable and scan the QR code">
    Select **Enable**. In **Set up two-step verification**, scan the QR code with your authenticator app. If you can't scan it, enter the setup key manually.
  </Step>

  <Step title="Verify the first code">
    Enter the 6-digit code from your app under **Verification code** and select **Verify**. Cogno confirms with **Two-step verification enabled.**
  </Step>
</Steps>

From then on, signing in shows a **Two-step verification** screen asking for the 6-digit code from your authenticator app before you can continue to Cogno.

### Disable two-step verification

In **Settings → Account → Security**, select **Disable** on the **Two-step verification** row, then confirm in the **Disable two-step verification?** dialog. Your account will no longer require an authenticator code when you sign in.

<Warning>
  If a workspace you belong to requires MFA, disabling two-step verification
  locks you out of that workspace until you enable it again.
</Warning>

## Require MFA for a workspace

On the Business plan, admins and Owners can make two-step verification mandatory for every member.

<Steps>
  <Step title="Verify your own MFA first">
    Set up and verify your own two-step verification before requiring it for everyone — the toggle stays disabled until you have.
  </Step>

  <Step title="Turn on the requirement">
    Open **Settings → Security** and turn on **Require MFA for this Workspace**.
  </Step>
</Steps>

The policy applies to every workspace member:

* Members who already use two-step verification are asked for their code when they sign in, as usual.
* Members who have not set it up are sent to their **Account** settings to enable it before they can enter the workspace.

On a Free workspace the toggle is disabled with the note **This setting is available on the Business plan** — see [Manage workspace billing](/docs/billing) to upgrade.

## Review the audit log

Open **Settings → Audit log** to see privileged actions in the workspace, newest first. The entry is visible to admins and Owners only.

Each entry shows:

* The **permission** that was exercised (for example, creating or revoking an API key, changing member roles, or managing execution environments).
* **Who acted** — a member name, **via machine** for actions taken through an enrolled machine, or **via service** for Cogno's own service actions.
* A summary of the **target** (the key details of what was changed).
* The **timestamp**.

Select **Load more** to page further back.

## Troubleshooting

| Symptom                                                                | Likely cause                                                         | Fix                                                                                  |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| **That code is incorrect or has expired.** at sign-in                  | The authenticator code rolled over                                   | Enter the latest code from your authenticator app.                                   |
| **You need to enable two-step verification to access this Workspace.** | The workspace requires MFA and your account has none                 | Enable two-step verification in **Settings → Account → Security**.                   |
| **Require MFA for this Workspace** toggle is disabled                  | Free plan, missing admin/Owner role, or your own MFA is not verified | Upgrade to Business, ask an admin or Owner, or set up and verify your own MFA first. |
| **No privileged actions recorded yet.**                                | Nothing privileged has happened in this workspace                    | Expected — entries appear as privileged actions occur.                               |
| **Failed to load the audit log**                                       | You lost access or the request failed                                | Confirm you are an admin or Owner, then retry.                                       |

For anything not listed here, see [Troubleshooting](/docs/troubleshooting).

## Related docs

* [Manage workspace billing](/docs/billing) — the Business plan unlocks the workspace MFA requirement.
* [Manage API keys](/docs/api-keys) — key creation and revocation appear in the audit log.