# How To Keep Required Sign-in Factors With BetterShield Ultra?

Stop people in enforced roles turning off their own two-factor or removing their last passkey.

In **[BetterShield Ultra](/ultra/)**, **Removing a factor** on **BetterShield › Ultra › Sign-in rules** stops people in an enforced role from removing the last factor their policy requires.

## What it does

When on, a person in an enforced role cannot turn off their own two-factor or remove their last passkey. They can remove one passkey when another remains. An administrator can still reset a person's factor.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Open BetterShield › Ultra › Sign-in rules

Open **BetterShield › Ultra › Sign-in rules**.

<figure class="doc-shot">
  <img src="/docs/screenshots/ultra-factor-removal-policy.png" alt="BetterShield Ultra Removing a factor card with the self-removal protection switch." width="982" height="162" loading="lazy" decoding="async">
  <figcaption>The self-removal protection is on by default.</figcaption>
</figure>

## Step 2: Keep Required Sign-in Factors

- Set **People in an enforced role cannot turn their own two-factor off or remove their last passkey**. It is on by default.
- Select **Save policies**.

It applies only where a two-factor or passkey role policy is enforced.

## Recommended settings

Our advice:

- Leave it on for every enforced role.
- Keep at least two trusted administrators able to reset an account.
- Confirm recovery before enforcing factors for the last administrator.

## What it can break and how to undo

A person cannot remove a broken last factor by themselves. An administrator can open the account under **Users** and reset its two-factor, or change the policy and save.

Turning this switch off weakens the policy and is recorded as a high-rated change.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

The switch remains on after saving.

- A person in an enforced role cannot remove their last required factor.
- An administrator still sees the account reset action.

<figure class="doc-shot">
  <img src="/docs/screenshots/ultra-factor-removal-policy.png" alt="BetterShield Ultra Removing a factor card with the self-removal protection switch." width="982" height="162" loading="lazy" decoding="async">
  <figcaption>Example Factor removal policy view. Check the saved values and status on your own site.</figcaption>
</figure>

## On multisite

The protection follows the site's own enforced roles. Network policy may add requirements separately.

## Related

- [Set up Ultra sign-in policies](/docs/sign-in-policies/)
- [Require two-factor by role](/docs/ultra-two-factor-policy/)
- [Ask roles to add a passkey](/docs/ultra-passkey-policy/)
- [Locked out](/docs/locked-out/)

This is how you can keep required sign-in factors with BetterShield Ultra.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).