Skip to main content
Summand handles MFA at sign-in. WorkOS runs the challenge for email-and-password sign-ins. SSO sign-ins skip the WorkOS MFA step and rely on your identity provider’s MFA policy.

​
Sign-in MFA via WorkOS

MFA can be required for every user in an organization. The setting lives in WorkOS, and Intelligible turns it on for your organization when you ask. It isn’t available in the Admin Portal. It applies to email-and-password sign-ins.

​
Enforcement

Two modes: To change the mode for your organization, contact support@intelligible.ai.

​
Enrollment flow

A new user with MFA required:
  1. Signs in with email and password.
  2. Hits the MFA enrollment screen with a QR code and a manual entry secret.
  3. Scans the QR with Google Authenticator, 1Password, Authy, or any TOTP app.
  4. Enters the 6-digit code to confirm.
  5. Future sign-ins prompt for the 6-digit code after credentials.
Users who sign in with SSO don’t see the MFA section in Settings → Security, because their identity provider handles it.

​
Recovery

If a user loses their device, contact support@intelligible.ai to reset their factor. The user re-enrolls on next sign-in. MFA in Summand is TOTP-based. Hardware keys (FIDO2 / WebAuthn) aren’t supported as a second factor.

​
Recommendation

For most enterprises:
  • Require sign-in MFA at the IdP and use SSO. Your IdP enforces it for every login attempt across every SaaS, including Summand.
  • Ask us to require MFA in WorkOS as a backstop for anyone who signs in with a password.
For HIPAA-regulated data, both are recommended.