How To Keep Required Sign-in Factors With BetterShield Ultra?
Stop people in enforced roles turning off their own two-factor or removing their last passkey.
In BetterShield Ultra, Removing a factor on BetterShield › Ultra › Sign-in rules stops people in an enforced role from removing the last factor their policy requires.
What it does
When on, a person in an enforced role cannot turn off their own two-factor or remove their last passkey. They can remove one passkey when another remains. An administrator can still reset a person’s factor.
Step 1: Open BetterShield › Ultra › Sign-in rules
Open BetterShield › Ultra › Sign-in rules.
Step 2: Keep Required Sign-in Factors
- Set People in an enforced role cannot turn their own two-factor off or remove their last passkey. It is on by default.
- Select Save policies.
It applies only where a two-factor or passkey role policy is enforced.
Recommended settings
Our advice:
- Leave it on for every enforced role.
- Keep at least two trusted administrators able to reset an account.
- Confirm recovery before enforcing factors for the last administrator.
What it can break and how to undo
A person cannot remove a broken last factor by themselves. An administrator can open the account under Users and reset its two-factor, or change the policy and save.
Turning this switch off weakens the policy and is recorded as a high-rated change.
Final Outcome
The switch remains on after saving.
- A person in an enforced role cannot remove their last required factor.
- An administrator still sees the account reset action.
On multisite
The protection follows the site’s own enforced roles. Network policy may add requirements separately.
Related
This is how you can keep required sign-in factors with BetterShield Ultra.
Getting Stuck? Feel free to contact our Dedicated Support Team.