An organization requires two-factor authentication. What should administrators ensure members understand about 2FA recovery codes?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Treat 2FA recovery codes like spare keys in a safe—not in git, and they don't blow up enterprise SSO when used.
Full explanation below image
Full Explanation
When 2FA is required, users receive one-time recovery codes that can regain account access if authenticators are lost. Secure storage in offline media or an approved enterprise secrets process is mandatory; posting codes in repositories or chat creates account takeover risk. Using a recovery code does not disable enterprise SAML SSO for everyone. Recovery codes are user-account 2FA artifacts, not a substitute for Management Console credential procedures on GHES. Organization owners should plan owner account recovery, avoid single-owner lockout, and document identity-provider-based recovery paths for EMU where user 2FA is managed differently. Regular access reviews should confirm owners still have working second factors.