How to Set Up and Enforce Two-Factor Authentication (2FA) in Nextcloud

A Nextcloud user reaches the login page, enters the right password, and then gets stuck because the server requires a second factor they never configured. This usually happens when an administrator turns on mandatory two-factor authentication (2FA) before enabling a provider, testing the enrollment flow, and preparing users for recovery. The safer fix is to enable a supported provider first, pilot it with a small group, and only then enforce 2FA for the intended accounts.

The steps below follow the Nextcloud 35 stable administration and user manuals available on October 6, 2026. Nextcloud’s interface and available provider apps can vary by server release and deployment, so confirm the documentation for your installed version before changing a production instance.

Why does enforcing 2FA cause login problems?

Nextcloud treats 2FA as a pluggable feature: an administrator enables one or more provider apps, and users configure a factor in personal settings, unless the administrator enforces the requirement. A policy without an available provider, a user who has not enrolled, or a lost authenticator can interrupt sign-in. Recovery codes and a tested administrative recovery route reduce that risk.

Enforcing 2FA also affects applications that connect to Nextcloud. In Nextcloud 35, client applications that cannot complete a second-factor challenge need device-specific app passwords. Plan for desktop sync clients, mobile apps, and integrations before rollout.

1. Choose who must use 2FA

Start by mapping the policy to Nextcloud groups. Decide whether the rule applies to everyone, selected departments, or all human users except a small, documented set of service accounts. Make sure the relevant accounts actually belong to the groups you intend to target. Avoid broad exclusions: an excluded account does not receive the same login protection as an enforced account.

Nextcloud’s group logic matters. If no groups are selected for enforcement, the rule applies to everyone except members of excluded groups. If you select groups, the rule applies to members of those groups; membership in a selected group takes precedence if that user is also in an excluded group. Confirm these rules in the official Nextcloud 35 two-factor authentication documentation before saving a policy with exceptions.

2. Enable at least one provider and test enrollment

In the administrator account, open Apps and check disabled apps for a provider such as Two-Factor TOTP Provider. The Nextcloud 35 manual says TOTP may be installed but disabled by default; the notification-based provider may also need enabling. The built-in backup-code provider is available for account recovery. Other provider apps can be offered in the Nextcloud App Store, but confirm that an app supports your installed server version before relying on it.

For a small pilot, enable TOTP and ask a test user to open personal settings, find Second-factor Auth, scan the displayed QR code with a compatible authenticator app, and confirm enrollment. Do this with an account you can safely reset. Keep a separate administrator session open while testing. Do not enforce the rule on the entire instance until a normal user and an administrator have both completed a fresh login with the second factor.

Users should generate one-time backup codes from their personal second-factor settings and store them separately from the phone or security key they use to sign in. The official Nextcloud user guide to 2FA explains TOTP setup, recovery codes, login prompts, and device-specific passwords.

3. Enforce the requirement in Administration Settings

When the pilot can sign in and recover access, open Administration settings > Security and find the two-factor authentication section. Enable the enforcement setting. If only some users are included, select the groups you chose in Step 1 and check the excluded-groups list carefully. If you intend to require 2FA from everyone, leave the selected-groups limit empty; use exclusions only when there is a specific operational reason and an alternative safeguard.

Tell users when the policy takes effect, which provider to configure, where to generate backup codes, and how to request help. If you have a large deployment, expand the rollout by group rather than switching the whole server at once. That gives administrators a chance to catch missing group membership, unsupported clients, and provider-specific issues before they affect everyone.

4. Use occ when you need a repeatable server-side change

Administrators can also enforce 2FA with Nextcloud’s occ command. Run it from the Nextcloud installation directory as the web-server account; the account name, PHP command, and installation path vary by host or container. The following examples use the common Linux web user www-data shown in the Nextcloud manual:

sudo -E -u www-data php occ twofactorauth:enforce --on

To require 2FA for chosen groups, optionally excluding a service-account group, use:

sudo -E -u www-data php occ twofactorauth:enforce --on \
  --group=staff --group=admins --exclude=service-accounts

Replace those example group IDs and the web-server account with values from your instance. The command can turn enforcement off if a rollout needs to be paused:

sudo -E -u www-data php occ twofactorauth:enforce --off

Use the current Nextcloud occ reference to confirm the syntax for your release. For Docker or another managed deployment, execute occ inside the correct application environment using that deployment’s documented user and command; do not run a host-level example blindly.

5. Prepare for lost devices and client apps

If a user loses the phone or key that holds their factor and also loses their backup codes, they may be unable to sign in. Before enforcement, test your recovery procedure with a noncritical account. Nextcloud provides provider-specific occ twofactorauth:disable and twofactorauth:enable commands when the provider supports them; not every provider supports per-user changes. The Two-Factor Admin Support app is another recovery option for supported Nextcloud versions. Verify its compatibility and installation status before depending on it.

Do not disable or remove a provider that users have already configured without planning the transition. Nextcloud can retain provider associations after an app is removed, which may cause authentication errors. Its administration manual documents a cleanup command for providers that are permanently removed; that cleanup is irreversible, so use it only when you do not plan to enable that provider again.

For desktop and mobile clients that cannot answer an interactive 2FA prompt, have users create app passwords from their Nextcloud account settings and update the client credentials. The Nextcloud 35 documentation states that app passwords are mandatory for accounts with 2FA enabled. A browser login test alone will not confirm that sync clients and integrations still work.

Verify that enforcement works

Test with a pilot user in a private browser window or after signing out. Enter the usual username and password, then confirm Nextcloud asks for the configured second factor and accepts a valid code. Test a backup code once if your recovery procedure allows it, remembering that backup codes are one-time use. Next, test the client apps and integrations that your organization depends on.

For a specific account, run the status command from the Nextcloud directory:

sudo -E -u www-data php occ twofactorauth:state username

Check that the account is covered by the intended enforcement policy and that its chosen provider is active. If a selected user is not required to use 2FA, inspect group membership and exclusions before changing the global rule. The setup is complete when the intended users are challenged at login, excluded accounts are limited to the documented exceptions, recovery has been tested, and supported clients can reconnect with their app passwords.

Official references

• Nextcloud 35 Administration Manual: Two-factor authentication
• Nextcloud 35 Administration Manual: 2FA occ commands
• Nextcloud 35 User Manual: Using two-factor authentication
• Nextcloud 35 Administration Manual: App passwords
• Nextcloud App Store: Two-Factor Admin Support