We use Smartsheet for several of our clients. One of our clients has requested that we enforce multi-factor authentication (MFA) using an authenticator app such as Google Authenticator or Microsoft Authenticator. My colleague (our Smartsheet admin) enabled MFA in the admin settings, but we are running into two issues: * Only users marked as Members receive the MFA prompt. They have activated it and with them it works. Guests/Free Users do not seem to get any MFA notification. * The MFA prompt only appears when users log in using the methodes email + password. When logging in with, for example, Microsoft SSO, there is no option at all to activate or configure MFA. The same applies to the other login methods. MFA activation is only available when signing in with email + password. I haven’t been able to find any information explaining whether - and how - we can enforce MFA for all users (including guests and free users), and whether MFA can also be required for all other login methods. Is it possible to enforce MFA for all user types and all login methods within the Smartsheet Business plan? If so, how and where can this be configured? Thanks in advance!

Enforcing MFA for all users (not only Members) and for all login methods?

We use Smartsheet for several of our clients. One of our clients has requested that we enforce multi-factor authentication (MFA) using an authenticator app such as Google Authenticator or Microsoft Authenticator.

My colleague (our Smartsheet admin) enabled MFA in the admin settings, but we are running into two issues:

Only users marked as Members receive the MFA prompt. They have activated it and with them it works. Guests/Free Users do not seem to get any MFA notification.
The MFA prompt only appears when users log in using the methodes email + password. When logging in with, for example, Microsoft SSO, there is no option at all to activate or configure MFA. The same applies to the other login methods. MFA activation is only available when signing in with email + password.

I haven’t been able to find any information explaining whether - and how - we can enforce MFA for all users (including guests and free users), and whether MFA can also be required for all other login methods.

Is it possible to enforce MFA for all user types and all login methods within the Smartsheet Business plan? If so, how and where can this be configured? Thanks in advance!

Find more posts tagged with

Security

Authentication and Sign in

MFA

Authentication

Multi-Factor Authentication

Accepted answers

All comments

JStenson

Hi. We enabled MFA last week on our system following the announcement that it was now available as part of our Business plan licence. We were expecting it to work for all users based on the documentation that came with the Smartsheet announcement but we have the same issue that it's not working for guests and free users. I've logged this with Smartsheet support who haven't come back to me yet.

VLoo

Thank you for your response. Just to clarify, once MFA is working for all users in the Business plan, will it be applicable to all login methods, not only just email and password?

JStenson

Hi - we only use email address and password to login so I don't have experience with the other authentication methods.

JStenson

Smartsheet support have come back to me and have said that MFA is only available for internal users on the Business plan. I've raised this with my Account Manager as I don't understand why any organisation would only want a partial MFA implementation, where some users are prompted for MFA and others (external users) are not, as that's an incomplete security control. This is the response from my Account Manager:

1. MFA for non-SSO Smartsheet logins

This MFA option applies to users on your plan who authenticate directly with Smartsheet (not via SSO). This is the feature that is available at no additional cost across plans, including Business.

2. Enhanced “Require MFA” Governance Policy for External Collaborators

This is a separate feature that controls MFA requirements for external (non-plan-member) collaborators using an authenticator app.
This governance policy is part of the broader Enterprise-level security controls.

I really don't understand why Smartsheet are making a distinction between internal and external users with their implementation of MFA, apart from encouraging upgrades to Enterprise licences. Our external users have usernames and passwords just like our internal users and the MFA process would be exactly the same.

Sign in to join the conversation!

Quick Links

Component react.discussion.discussions had an error.

ref must be one of: categoryID, siteSectionID, category, category/categoryID, category/name, category/description, category/url, category/allowedDiscussionTypes, locale, siteSection, siteSection/basePath, siteSection/contentLocale, siteSection/sectionGroup, siteSection/sectionID, siteSection/name, siteSection/description, siteSection/apps, siteSection/attributes, layoutViewType, discussionID, commentID, page, latest, sort, sortType, lookupSort, discussion, discussion/name, tags, breadcrumbs, discussionApiParams, serverDraftID, serverDraft.