Action
How to Require Two-Factor Authentication for Discord Server Staff
Set up Multi-Factor Authentication on each staff account to add an extra layer of security.
Is this your situation?
You manage a server and want staff accounts protected with two-factor authentication before giving them access. You want to know what setting up Multi-Factor Authentication actually secures for each account.
The short answer
You want to know what requiring two-factor actually secures for staff. Set up two-factor authentication on each staff account, since Multi-Factor Authentication adds an extra layer of security.
Before you start
- Confirm MFA is enabled on your own account Multi-Factor Authentication adds an extra layer of security.Verify: Check your account settings for this.
- Decide which MFA type staff should use Discord supports three types: Security Keys, Authenticator App, and SMS.Verify: Check which method each staff member already has.
- Review Discord's recommended method Discord recommends setting up a Security Key for MFA.Verify: Check whether staff have a Security Key available.
- Check backup codes are saved Users should save their backup codes after enabling MFA.Verify: Check that each staff member has downloaded codes.
How Discord handles this
- An Authenticator App secures an account by providing a one-time code alongside the password.
- A password alone is not enough to log in if an Authenticator App is enabled, because the code is also required.
- SMS MFA is better than no MFA but not by a lot.
- Discord does not recommend SMS MFA.
Step by step
- Open User Settings Select the cogwheel icon next to your username to open settings.Confirm: The My Account page opens.
- Find Multi-Factor Authentication options Multi-Factor Authentication options can be viewed under the Password and Authentication section.Confirm: Check the Password and Authentication section for MFA options.
- Choose Security Key setup Select Register a Security Key and follow the prompts to reauthenticate.Confirm: The operating system prompts you to enroll a passkey if supported.
- Or enable an Authenticator App Press the Enable Authenticator App button to begin setup.Confirm: The Authenticator App's camera is used to scan a QR code displayed on desktop or browser.
- Scan the QR code Use the Authenticator App's camera function to scan the QR code displayed in the Discord app.Confirm: The app generates a 6 digit code.
- Enter the generated code Enter the 6 digit code into Login with your code and tap Activate.Confirm: Check that Discord confirms the code was accepted.
- Save backup codes Discord provides a list of backup codes for login after enabling an Authenticator App.Confirm: Check that a codes list is shown for download.If this fails: If codes are lost, Discord cannot help regain account access.
- Repeat for each staff member Ask each staff member to save their own backup codes after enabling MFA.Confirm: Check with each staff member that setup is complete.
- Confirm each account is secured A password alone is not enough to log in once an Authenticator App is enabled, since the code is also required.Confirm: Check that each staff member is prompted for a code at login.
Common mistakes
- Relying on SMS alone Hackers can intercept text messages and take over phone numbers through a SIM swap with carriers.Why it happens: SMS feels convenient, but Discord does not recommend it.
- Losing backup codes If backup codes are lost, Discord cannot help the user regain account access.Why it happens: Codes are not downloaded or stored before they are needed.Already happened: If you are already locked out, see recovering a locked-out account.
- Authenticator App without sync Not all Authenticator Apps support syncing across devices or on the cloud.Why it happens: A staff member switches phones without transferring the app.
- Losing a phone with no backup codes If a user loses their phone without access to backup codes, they might not be able to log in.Why it happens: Backup codes were never saved separately from the phone.
Roles at a glance
| MFA type | What it requires | Strength | Discord's guidance |
|---|---|---|---|
| Security Key | Not stated by Discord | Discord recommends setting up a Security Key for MFA. | See guidance column. |
| Authenticator App | A one-time code alongside the password. | A password alone is not enough to log in once this is enabled. | Not stated by Discord |
| SMS | Not stated by Discord | Better than no MFA but not by a lot. | Discord does not recommend SMS MFA. |
| Backup codes | One-time use codes given after signing up for MFA. | Each backup code can only be used once. | Discord recommends storing backup codes in a password manager. |
| No MFA | Not stated by Discord | Not stated by Discord | Not stated by Discord |
Keeping track of who has access
You have secured each staff account and want a clear picture of who set up what. Delvia keeps that record in one place, so you are not checking each account by hand to track access.
Was this helpful?