Two-Factor Authentication for Your ERP: Why and How

Why a password alone does not protect an ERP

An ERP holds the most sensitive data a small business has: bank details, customer and supplier balances, payroll, prices and margins. Anyone who signs in as a finance or admin user can see it, change it, or approve payments.

Passwords leak. They are reused on other sites, typed into convincing fake sign-in pages, guessed, or written on a note beside the screen. Once a password is known, nothing else stands between the attacker and the account.

Two-factor authentication closes that gap. The second step is a short code from an app on the user's own phone, which changes every 30 seconds. Knowing the password is no longer enough; the attacker would also need the phone.

Why this happens

• admin and finance users sign in with a password only
• staff reuse the same password on other websites
• nobody notices repeated failed sign-in attempts
• there is no plan for a user who loses their phone
• security settings are changed without the account owner knowing

Biznsbook addresses this through authenticator app codes (TOTP), one-time backup codes, MFA required by role, MFA events in the audit log, available to every user without an extra licence.

Most account takeovers start with a reused or phished password. A second step on the user's own phone stops them.

Step-by-step: Two-Factor Authentication for Your ERP: Why and How

Written for owners, administrators and every user who signs in to Biznsbook.

1. Open My account. Open your name menu and choose My account. The Multi-factor authentication card shows whether MFA is On or Off.
2. Start setup. Click Set up MFA. The page walks through three steps and has a guide panel with common questions.
3. Install an authenticator app. Any standard time-based (TOTP) app works, such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden.
4. Scan the QR code. In the app tap Add account and scan the QR code. If you cannot scan, copy the setup key and add it as a time-based account named Biznsbook.
5. Confirm with a code. Type the 6-digit code from the app and click Turn on MFA.
6. Save the backup codes. Eight one-time backup codes are shown once. Copy, download or print them and keep them somewhere safe, such as a password manager.
7. Require it for key roles. A platform administrator can tick roles such as SiteAdmin and CompanyAdmin under Require multi-factor authentication on the Session Security page.

Review results after the first full monthly cycle. Adjust roles, mappings, or approvals where the same exception repeats.

Screen names in this guide match Biznsbook: My account, Set up MFA, Manage MFA, Two-step verification, Use a backup code, Session Security and Manage users.

Common mistakes to avoid

• Mistake 1: Admin and finance users sign in with a password only Repeating this each month usually shows up first in a hijacked account or a locked-out user.
• Mistake 2: Staff reuse the same password on other websites Repeating this each month usually shows up first in a hijacked account or a locked-out user.
• Mistake 3: Nobody notices repeated failed sign-in attempts Repeating this each month usually shows up first in a hijacked account or a locked-out user.
• Mistake 4: There is no plan for a user who loses their phone Repeating this each month usually shows up first in a hijacked account or a locked-out user.
• Mistake 5: Security settings are changed without the account owner knowing Repeating this each month usually shows up first in a hijacked account or a locked-out user.

Each of these leaves an account open to anyone who learns the password, or locks out the real user when a phone is lost. Fix them before you need them.

Best practices that hold up as you scale

• Open My account — Open your name menu and choose My account.
• Start setup — Click Set up MFA.
• Install an authenticator app — Any standard time-based (TOTP) app works, such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden.
• Scan the QR code — In the app tap Add account and scan the QR code.
• Confirm with a code — Type the 6-digit code from the app and click Turn on MFA.

Turn MFA on for administrators first, keep backup codes away from the phone, and agree a recovery routine before anyone needs it.

How Biznsbook supports this workflow

authenticator app codes (TOTP) is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.

one-time backup codes is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.

MFA required by role is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.

MFA events in the audit log is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.

MFA uses an authenticator app; SMS and email codes, security keys and passkeys are not supported for sign-in. Customer, owner and supplier portals use their own sign-in.

Suggested implementation timeline

1. Day 1: Administrators and finance users turn on MFA from My account and save their backup codes.
2. Week 1: Ask the rest of the team to turn it on, and agree who may reset MFA for a user.
3. Week 2: Require MFA for administrator roles on the Session Security page.
4. Ongoing: Review MFA events in the security audit log and remind users to keep backup codes current.

Related guides

Cluster hub: ERP security guides. Start with set up two-factor authentication, then recover after losing your authenticator.

How authenticator codes work

When you scan the QR code, your authenticator app and Biznsbook share a secret key. From then on the app combines that key with the current time to produce a 6-digit code that changes every 30 seconds. Biznsbook does the same calculation and accepts the code only if the two match.

Because the code is calculated on the phone, it works without mobile signal and is never sent over SMS, where it could be intercepted or redirected to another SIM. If the code is rejected, the usual reason is the phone's clock: set the date and time to automatic and use the newest code.

Biznsbook keeps the setup key private on the setup page behind a "Can't scan? Enter the key instead" link, with a warning that anyone with the key can create your codes.

Backup codes and lost phones

When MFA is turned on, Biznsbook shows eight backup codes once, with Copy all, Download .txt and Print buttons. Each code works once in place of an app code. The Manage MFA page shows how many unused codes are left, and Create new backup codes replaces the whole set; the old codes stop working.

A user who loses their phone chooses "Lost your phone? Use a backup code" at sign-in. After signing in, Biznsbook emails a link that turns MFA off so they can set it up on the new phone. If they have no backup codes left, a company administrator can use Reset MFA on the user in Manage users, after checking who they are.

Backup codes are stored as one-way hashes, so nobody, including Biznsbook staff, can read them later.

Remember this device, lockout and alerts

On a computer only you use, tick "Remember this device for 30 days" on the code screen to skip the code on that browser. Turning MFA off or on again ends it.

Repeated wrong passwords, authenticator codes or backup codes lock sign-in for 15 minutes. Every MFA sign-in, failure, lockout and setting change is recorded in the security audit log.

The account owner is emailed whenever MFA is turned on or off, backup codes are renewed, or an administrator resets MFA. If they did not make the change, the email tells them to change their password and contact their administrator.

Metrics to track monthly

• Users with MFA on
• Administrators without MFA
• Account lockouts this month
• MFA resets by administrators

Start with three metrics; trend direction matters more than a single point-in-time snapshot.

Password-only sign-in vs Biznsbook MFA

Compare password-only sign-in with Biznsbook authenticator app codes (TOTP) and the related sign-in protections.

Rolling MFA out to a team

Start with the people who can change users, bank details and payments. Ask them to turn MFA on themselves from My account and save their backup codes, then require it for their roles on the Session Security page. Tell everyone before you switch on the requirement, and agree who in the company can reset MFA for a user who loses both phone and backup codes.

Write the MFA and recovery routine into your onboarding notes for new users.

Frequently asked questions

How this differs by industry