Multi-factor authentication (MFA)
Beginning November 4, 2026, Medallia requires 2-step verification, also called multifactor authentication (MFA), for users who sign in to Agile Research with a password. If you haven’t set it up yet, you’ll be taken to the setup screen the next time you log in. You won’t be able to access the rest of Agile Research until setup is finished.
Setup takes a few minutes. Follow the steps in this topic to complete the process.
Set up 2-step verification
To set up 2-step verification, you'll need an authenticator app. It generates a new code every few seconds, which you enter each time you sign in.
On your phone — Use an app such as Google Authenticator or Okta Verify.
On your computer — Use a desktop authenticator, browser extension, or password manager that supports TOTP.
Check with your IT team before you install anything. Many organizations restrict which software can be installed on work devices and some provide approved options.
Complete the following steps:
On the setup screen in Agile Research, click Turn On. A QR code and a setup key appear.
In your authenticator, add a new account and scan the QR code. If you can’t scan it, copy the setup key shown below the QR code and paste it into your authenticator.
Enter the 6-digit code shown in your authenticator, then click Next.
After you verify, you'll go to your surveys list. From then on, you’ll enter a code from your authenticator each time you sign in.
Keep the setup screen open until you’ve finished. If you leave it, you’ll return to the same screen the next time you sign in.
For detailed steps for phones and computers, see Signing in with 2-step verification.
Frequently asked questions
Why is Medallia requiring this now?
Medallia continuously evaluates its security policies in light of emerging threats and industry best practices. Credential leaks, password reuse, and automated credential-stuffing attacks continue to rise across all industries. Requiring a second factor protects your account and your organization’s data, even if a password is compromised.
What is multifactor authentication (MFA)?
MFA requires you to verify your identity with both your password and a code from a separate source, such as an authenticator app. Even if someone gets your password, they can’t sign in without the code.I sign in with SSO. Does this affect me?
No. If you sign in through your organization’s single sign-on (SSO), you can keep using it. 2-step verification applies only when you sign in to Agile Research with an email address and password.
I'm a Medallia Experience Cloud (MEC) customer. Do I have other options?
MEC customers can ask to turn off email and password login for Agile Research and require all users to sign in through SSO from the MEC Application Switcher. Your Agile Research account administrator can request this by submitting a Support ticket.
Can several people use the same login or a group email address?
No. 2-step verification is tied to one person’s authenticator, so each person needs an individual user with an individual email address. This includes team, department, or role-based addresses, such as a shared inbox.
If your organization uses a shared login, contact your account administrator to create separate users for each person who needs access. See Adding users to your account for details and why Medallia recommends it in Reasons to use a unique login for each user. You'll still need to set up 2-step verification on your own login before you can continue. Your administrator can create the new users before or after November 4, 2026.
Can I turn off 2-step verification or get an exception?
2-step verification is a Medallia security requirement, so it can’t be turned off for individual users. If your organization has questions or concerns about this requirement, your account administrator can contact Medallia Support to speak with the Global Security & Compliance (GSC) team.
Troubleshooting
My code isn't working.
Check that your phone's date and time are set to update automatically. If they're off, codes won't match.
Codes refresh every 30 seconds. Enter the one that's showing now.
Make sure you're reading the code for your Agile Research entry, not another account.
I can't scan the QR code.
Use the setup key instead. Copy the key shown below the QR code and paste it into your authenticator. This works on a phone or a computer, including when you’re viewing Agile Research on the same phone.
My password expired.
You'll be asked to update your password first, then you can set up MFA. The requirements for a new password appear on the Change Password page.
My account is blocked.
An account is blocked after repeated failed password attempts. This is separate from 2-step verification. Contact your account administrator to have your account unblocked.
I got a new phone or lost access to my authenticator app.
Contact your account administrator, who can ask Medallia Support to reset your 2-step verification. For security reasons, Support will verify your identity before making changes to your account.
I don't know who my administrator is.
Contact Support to get your request to the right person.
Still need help?
Contact your account administrator. Account administrators can contact Support directly. Don't include passwords or authentication codes in your message.
