diff --git a/app/controllers/two_factor_authentication/settings_controller.rb b/app/controllers/two_factor_authentication/settings_controller.rb
index 72207585dd..de7fe6f240 100644
--- a/app/controllers/two_factor_authentication/settings_controller.rb
+++ b/app/controllers/two_factor_authentication/settings_controller.rb
@@ -3,6 +3,7 @@ module ::TwoFactorAuthentication
 
     before_action :require_admin
     before_action :check_enabled
+    before_action :check_ee
 
     layout 'admin'
     menu_item :two_factor_authentication
@@ -48,6 +49,12 @@ module ::TwoFactorAuthentication
       render_403 unless manager.configurable_by_ui?
     end
 
+    def check_ee
+      unless EnterpriseToken.allows_to?(:two_factor_authentication)
+        render template: 'two_factor_authentication/upsale'
+      end
+    end
+
     def manager
       ::OpenProject::TwoFactorAuthentication::TokenStrategyManager
     end