How do I turn on Meta's two-factor authentication requirement for our whole business portfolio?

TofuAnswer by the Tofu team · checked

Two antique gold skeleton keys lying side by side on a white background, tied with thin pink ribbons

Someone with full control sets Two-factor authentication to Everyone in Meta Business Suite, under Settings > Business portfolio info > Business options. Confirm, and it takes effect at once. People who haven't set it up are asked to the next time they open the portfolio, and each person does it on their own Facebook profile. Meta already requires it for some portfolios more than 90 days old, and then you can't turn it off.

As of November 2026.

Already hacked? See how to get a hacked Meta business portfolio back.

Why does Meta say two-factor authentication is required for our portfolio?

Because Meta requires it for some portfolios and some advertisers. Meta says it "automatically requires two-factor authentication for some business portfolios that are more than 90 days old," and then the No one option isn't available. Its Security Center page words it more broadly, as a requirement for portfolios 90 days or older. Separately, Meta says advertisers may need two-factor authentication to publish ads, including people targeting certain regions, and that without it Meta may restrict or remove their access to advertising.

Should we choose Admins only or Everyone?

Admins only covers people with full control of the portfolio. Everyone covers "all people with any level of access to the business portfolio." Meta's Security Center page recommends requiring it for everyone with access. For a team that runs ads, Everyone is the safer pick, because Meta may ask anyone who publishes ads for it anyway.

Can teammates without two-factor authentication still manage our ads?

Not once the requirement covers them. Meta says they must turn it on before they can access the portfolio, and they're prompted the next time they try. Under Admins only, people with partial access can still get in, but Meta may still ask them for two-factor authentication before they publish ads. If Meta requires Advanced Protection on their account and they don't finish setup, Meta says they may lose access to certain features or to their account.

How does each person turn it on?

On their own Facebook profile: profile picture > Settings & privacy > Settings > Accounts Center > Password and security > Two-factor authentication, then pick the account. Meta offers three methods: a security key, an authentication app or text message (SMS). Each person should also save Meta's 10 recovery codes, under Additional methods > Recovery codes. Each code works only once.

Do passkeys count instead of two-factor authentication?

Meta's pages don't agree. Its Advanced Protection page says accounts added to business portfolios that advertise with Meta must enroll, and need to "either turn on two factor authentication or create a passkey." Its passkeys page says enrolled accounts are "required to create a passkey" and are locked out until they do, and its business help says people in or linked to some portfolios, such as ones that advertise with Meta, "may be required to create a passkey," with no date. Corbado, a passkey vendor, wrote on October 29, 2026 that Meta has been rolling out required passkeys for people tied to ad business portfolios since August 2026; we found no Meta announcement of this. Setting up both meets either rule.

Does the requirement cover our agency and our tools?

Meta's pages don't say whether your setting reaches people who work on your assets from a partner's portfolio. Its guide to sharing assets with a partner lists turning on the requirement as a step before you share; see how to give your agency access to your Meta ad account. If you manage Pages or ad accounts through a third-party app, Meta says you'll be asked for a code the next time you sign in from it. System users, which Meta describes as servers or software that make API calls, aren't mentioned on its two-factor pages.

How do I see who still hasn't set it up?

Export your people list: Settings > People > Export > People and permissions > Create export file, then Download. The file shows each person's two-factor status, but only while the requirement is on, and only people with full control can export it. Meta's security best practices also say to remove people without passkeys or two-factor authentication "until they have." If Meta has already removed people, see why Meta removed inactive people from our business portfolio.

A teammate lost their phone and can't get in. What now?

Meta suggests waiting for a delayed text, approving the login from a device where they're still signed in, or using a recovery code. If none works, on a computer they click Need another way to authenticate?, then Other Options, then Get more help. Meta may ask for an ID photo and usually replies in 1 to 2 business days. Meta's Security Center page also suggests a second person with full control, so the portfolio doesn't depend on one person.

Why does Meta ask for a code every time we log in?

Meta has to remember your browser to recognize you. In private browsing, or a browser that clears its history when you close it, Meta can't remember your device, so you may need a code at every login.

Sources (14)

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

Related answers

More on