> ## Documentation Index
> Fetch the complete documentation index at: https://docs.assuric.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Email verification, multi-factor authentication required by permission level, and how sign-in works.

<Note>
  **Quick summary**

  * Assuric uses passwordless, email-verified sign-in.
  * MFA is off by default, and an Admin can require it per permission level.
  * Our team sets up custom SSO for identity providers other than Google.
</Note>

## Workspace setting: Settings → Authentication

<Frame caption="The Authentication tab, showing Email Verification and the Multi-Factor Authentication requirement.">
  <img src="https://mintcdn.com/assuric-docs/bQmLu3QSd1d6-sNU/images/settings/access-authentication-tab.png?fit=max&auto=format&n=bQmLu3QSd1d6-sNU&q=85&s=86fcee91bb45f3ed13ec7acd81d71bdc" alt="The Authentication tab under Workspace Settings, showing Email Verification and Multi-Factor Authentication sections" width="1000" height="580" data-path="images/settings/access-authentication-tab.png" />
</Frame>

| Setting | What it does |
| - | - |
| **Email Verification** | Always on: every passwordless sign-in goes through a verified email |
| **Multi-Factor Authentication** | Off by default: click **Edit** and pick the [permission levels](/people/permissions-and-access) (*Admin*, *User*, *Viewer* or *Staff Portal*) that must set up an authenticator app before they can access the organisation |

The setting calls these levels *roles*, but they aren't the roles on the **Roles** tab.

<Info>
  Requiring multi-factor authentication (MFA) for a permission level doesn't lock out people already signed in; at their next sign-in, they must set up an authenticator app first.
</Info>

Only an Admin who has enrolled an authenticator app can change the requirement. Until then, **Edit** stays disabled with the message "You must have a multi-factor authentication device enrolled to change this setting."

## Set up your own authenticator app

Anyone can set up an authenticator app from their account menu (their initial, top right): **Authentication → Account Security**, whether or not their permission level requires it.

<Frame caption="Account Security, on the Authentication tab of your profile settings, with Set up an authenticator app.">
  <img src="https://mintcdn.com/assuric-docs/bQmLu3QSd1d6-sNU/images/settings/access-account-security-tab.png?fit=max&auto=format&n=bQmLu3QSd1d6-sNU&q=85&s=e31621ce3ad62d9a0597300022c5105d" alt="The Account Security section of personal settings, showing the Authentication App card" width="1000" height="354" data-path="images/settings/access-account-security-tab.png" />
</Frame>

## Single sign-on

Custom single sign-on isn't self-service in this screen: our team can set it up if you use an identity provider other than Google.

<Tip>
  **What we recommend**

  Require MFA at least for *Admin* and *User*, which can change records, clinical data or workspace settings. Add *Viewer* too: view-only accounts such as auditors' can see everything.
</Tip>

## Related articles

<Columns cols={2}>
  <Card title="Navigating Assuric" icon="map" href="/assuric-overview/navigating-assuric">
    The sign-in flow this page administers.
  </Card>

  <Card title="Permissions and access (authentication and authorisation)" icon="user-cog" href="/people/permissions-and-access">
    The permission levels the multi-factor authentication requirement is set against.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.