An organization requires two-factor authentication. What should administrators ensure members understand about 2FA recovery codes?
Select an answer to reveal the explanation.
Short Explanation
Treat 2FA recovery codes like spare keys in a safe—not in git, and they don't blow up enterprise SSO when used.
Full Explanation
When 2FA is required, users receive one-time recovery codes that can regain account access if authenticators are lost. Secure storage in offline media or an approved enterprise secrets process is mandatory; posting codes in repositories or chat creates account takeover risk. Using a recovery code does not disable enterprise SAML SSO for everyone. Recovery codes are user-account 2FA artifacts, not a substitute for Management Console credential procedures on GHES. Organization owners should plan owner account recovery, avoid single-owner lockout, and document identity-provider-based recovery paths for EMU where user 2FA is managed differently. Regular access reviews should confirm owners still have working second factors.