Overview
Two-factor authentication is built into Magento 2.4 and is on by default, so every admin user has to enrol before they can reach the dashboard.
Enrolment does not happen in the user's account settings. Magento emails each user a one-time setup link on their first sign-in after 2FA is active, and the setup screen is where the authenticator app is paired.
The key point: If a user cannot find any 2FA option in their profile, that is expected behaviour, not a fault.
This guide covers what Magento provides, how to enrol a user, the two symptoms that get confused with each other, and how to reset someone who has lost their device.
What Magento Provides Out of the Box
Magento 2.4 ships the Magento_TwoFactorAuth module enabled. It supports several providers, including Google Authenticator and Duo Security, with the available list depending on your exact 2.4.x version.
The global settings live at:
Stores > Configuration > Security > 2FA
That is where you choose which providers are allowed for the store.
Enrolment is per user, not per store. Turning a provider on globally does not enrol anyone: each admin user completes their own pairing.
Step-by-Step: Enrol a User
Step 1 - Confirm the Store Can Send Transactional Email
The setup link arrives by email, so a broken mail configuration will block every new user.
Step 2 - Have the User Sign In as Normal
Magento intercepts the sign-in and either shows the provider selection screen or sends the setup link.
Step 3 - Pair the Authenticator App
The user opens the link, chooses a provider, and scans the QR code with their authenticator app.
Step 4 - Confirm the Pairing
The user enters the six-digit code. From then on, sign-in asks for username, password, and the current code.
The setup link is single use and time limited. If it expires, have the user attempt to sign in again to trigger a fresh one.
When the 2FA Option Is Missing or Access Is Denied
Two different symptoms get reported here, and they have different causes.
Symptom 1 - No 2FA Option Anywhere in the User's Profile
This is normal. Users do not self-enrol from account settings; they enrol through the sign-in interception described above.
Symptom 2 - "Sorry, you need permissions to view this content."
This is Magento's standard access-control denial. The user's role is missing the Two Factor Auth resources.
Go to System > Permissions > User Roles, open the role, and on the Role Resources tab grant the Two Factor Auth entries.
Roles set to Custom resources rather than All are the usual cause, and an upgrade that adds new resources will leave existing custom roles without them. If several users report the message at once shortly after an upgrade, check the role before you check anything else.
Resetting a User Who Has Lost Their Device
Magento provides command line reset so an administrator does not have to edit the database.
bin/magento list security:tfa
That lists the reset commands available in your version. Run the reset for the affected user and provider, and the user is prompted to enrol again on their next sign-in.
Keep at least two administrators enrolled so a lost device never locks out the whole store.
Do Not Disable 2FA on Production
Disabling the module removes the protection that stops credential stuffing against your admin.
If you need it off in a local development environment, disable the module there only, and never in the configuration your production deployment builds from.
If the reason you want it off is that enrolment is painful for a large team, fix the underlying cause instead: confirm transactional email is delivering, grant the Two Factor Auth role resources up front, and enrol people in small batches with someone available to reset the ones who fumble it.
Where Moogento Fits
Two-factor authentication tells you that the person signing in holds the right device. It does not tell you what they changed once they were inside.
If several people and agencies share admin access, pair 2FA with an admin audit log so that every login and every field change is recorded. That is what AuditEasy does for Magento 2.
FAQs
Where is the 2FA option in my Magento admin profile?
There is not one. Magento enrols you at sign-in and emails a setup link.
Why did I get "Sorry, you need permissions to view this content."?
Your admin role is missing the Two Factor Auth role resources. Grant them in System > Permissions > User Roles.
How do I reset 2FA for a user?
From the command line on the server. Run bin/magento list security:tfa to see the commands your version provides.
Is 2FA mandatory in Magento 2.4?
Yes, for admin users, out of the box.
Why did the setup link stop working?
It is single use and time limited. Sign in again to generate a fresh one.
Next Steps
To get a team enrolled without drama:
- Verify transactional email delivery first
- Grant the Two Factor Auth role resources before you invite anyone
- Enrol in small batches, with someone on hand to run resets
- Keep two administrators enrolled at all times
- Pair 2FA with an audit trail so you know what happened after sign-in
For the wider admin hardening picture (custom admin URL, patching, IP restrictions, account audits), see the securing Magento 2 guide.