.svg){kind=logo}
Troubleshooting 2FA: Edge Cases and Permissions
A reference guide to uncommon Two-Factor Authentication scenarios in Lucidya, including Remember Device behavior, automatic resets, failed attempt limits, and permission requirements.
This article covers uncommon scenarios, behavioral edge cases, and permission requirements related to Two-Factor Authentication in Lucidya.
Remember Device Behavior
The Remember Device option behaves differently depending on how 2FA was configured.
If a user enabled 2FA only from their Profile Settings, the Remember Device checkbox is shown by default on the login screen.
If the administrator enabled company-wide 2FA with Remember Device turned off, the checkbox does not appear on the login screen, regardless of the user's profile settings.
If the administrator enabled company-wide 2FA with Remember Device turned on, the "Don't ask again for 7 days" checkbox appears on the login screen.
Cancelling During Verification
If a user starts a verification process (such as enabling or disabling 2FA) and clicks Cancel before submitting a code, they must wait 1 minute before re-initiating the process. This prevents excessive verification code requests.
When 2FA Setup Gets Reset
A user's 2FA setup is automatically reset in the following situations.
The company administrator disables company-wide 2FA. This resets all user configurations including profile-level setups.
The user disables their own 2FA from Profile Settings (only possible when company-wide 2FA is not enforced).
The user had email 2FA enabled, but the administrator later re-enables company-wide 2FA without including the email method. The user must set up a new method at their next login.
The user had SMS enabled, but the administrator removes the company's SMS package. The user must set up a different method at their next login.
Failed Verification Attempt Limits
Different contexts have different limits and consequences.
Administrator enabling 2FA: 5 attempts. After 5 failures the Enable button is temporarily disabled with a retry tooltip. The account is not locked.
Administrator disabling 2FA: 5 attempts. After 5 failures the Disable and Edit buttons are temporarily disabled with a retry tooltip. The account is not locked.
Administrator editing 2FA: 5 attempts. After 5 failures the Disable and Edit buttons are temporarily disabled with a retry tooltip. The account is not locked.
User enabling 2FA from Profile: 5 attempts (or 10 total OTP requests). The process is paused and the button is disabled. The account is not locked.
User disabling 2FA from Profile: 5 attempts (or 10 total OTP requests). The Disable button is disabled. The account is not locked.
User at login page: 5 attempts (or 10 total OTP requests). The account is locked. The administrator is notified by email. A System Administrator must unlock the account.
Audit Logging
All 2FA-related actions are recorded in the system activity log, including enabling, disabling, and editing company-wide 2FA by administrators, enabling, disabling, and editing individual 2FA from user Profile Settings, and requesting the SMS verification package upgrade.
Permission Requirements
Enabling, disabling, and editing company-wide 2FA requires Manager permission in General Settings.
Viewing and managing bounced emails requires Manager permission in General Settings.
Enabling and disabling personal 2FA from Profile Settings is available to any authenticated user.
Unlocking suspended accounts requires System Administrator permission.
For further assistance contact Lucidya Support.
Frequently asked questions
Your administrator may have enabled company-wide 2FA with the Remember Device option turned off. This overrides any profile-level settings. Contact your administrator to check the configuration.
Wait 1 minute and try again. The system enforces a brief cooldown after cancellation to prevent excessive code requests.
This can occur if your administrator disabled and re-enabled company-wide 2FA, if your administrator changed the available verification methods, or if the SMS package was removed from your organization's account. You will need to set up 2FA again at your next login.
Yes. All 2FA-related actions, including enabling, disabling, editing, and SMS package requests, are logged in the system activity log and are available for audit purposes.