Multi-Factor Authentication (MFA) for Quip

How MFA Works in Quip

For most Quip sites, MFA is enabled by default and cannot be turned off. Every user who logs in directly to Quip — without going through an SSO provider like Okta, ADFS, or Ping Federate — must complete MFA at each login. Users who authenticate through SAML SSO are subject to whatever MFA policy their identity provider enforces, not Quip's built-in MFA.

Example: A company uses Okta for SSO. Their Quip site has MFA enabled, but because all users sign in via Okta, the Quip MFA prompt does not appear — Okta handles MFA instead. However, the Quip Admin account, which uses direct login for site administration, must still complete Quip's built-in MFA.

Supported Verification Methods

Quip supports the following MFA verification methods:

• Salesforce Authenticator: The Salesforce mobile app that generates push notifications or time-based one-time passcodes (TOTP)
• Third-party TOTP authenticator apps: Any app that supports the TOTP standard, such as Google Authenticator or Microsoft Authenticator
• Security keys: Physical hardware keys that support the FIDO2/WebAuthn standard, such as YubiKey

Users register their preferred verification method during their first MFA-required login. After registration, the method is associated with their Quip account.

How to Reset a User's MFA Verification Method

If a user loses access to their registered verification method — for example, if they get a new phone and lose their authenticator app — a site administrator can reset it so the user can register a new method.

1. In the Quip Admin Console, go to Site Members > Enabled Members.
2. Find the affected user and open their profile.
3. Click Reset Verification.

The next time the user logs in, they are prompted to register a new verification method before accessing the site.

Note: If the Quip site administrator themselves loses their MFA method, they cannot reset it from the Admin Console. Contact Quip Support to regain access.