As you may be aware, NetSuite released two-factor authentication (2FA) for highly privileged administrative permissions back in the 2018.2 release. This extra layer of authentication security, now (4/8/2019) enforced in all NetSuite accounts, is focused around increasing account security and had a widespread impact on user experience and integration on the platform. In this article, we will take a deep look inside the 2FA setup and its impact. We will also explore the latest ways to bypass 2FA requirement. We then will walk through detailed steps for setting up 2FA for those new to NetSuite. At the end, we will discuss dealing with 2FA in special circumstances.
Two-factor authentication (2FA) allows enforcement of a second level of security for logging in to the NetSuite user interface. Using 2FA can protect your company from unauthorized access to data (NetSuite). With 2FA enabled, a user will have to provide a verification code that will be generated dynamically in additional to email address and password to gain access to NetSuite from the User interface, integration and other contexts.
Starting on April 8th 2019, all production accounts will have mandatory 2FA enforced for Highly Privileged Roles. This means any integrations using these roles will no longer work after 4/8/2019. Account owners and NetSuite partners received a reminder email from NetSuite on 3/26/2019.
2FA will be enforced for any SDN accounts (leading and trailing) newly provisioned starting from version 2018.2 phase 1. All existing SDN accounts provisioned prior to NetSuite version 2018.2 phase 1 will NOT have 2FA enforced.
Although 2FA feature can be turned off for most of roles, NetSuite enforces 2FA on Highly Privileged roles/permissions even with 2FA Authentication Required option turned off on those roles. This is to prevent Highly Privileged roles being used in unauthorized access to your account.
As far as we discovered, the following default roles will have 2FA enforced:
According to NetSuite, any roles (custom or default) with following permissions will have 2FA enforced:
2FA feature can be turned on roles that do not have 2FA enforced for security needs. User can set the duration of trusted device. User can login without verification code within the set duration period if login is from the same machine (IP address). After the period, user will have to enter the verification code again.
Let’s face it, sometimes added security can add an additional burden. Here’s a few of our best practices you may want to employ to best deal with 2FA.
On the initial log in, NetSuite will send a security code to the shared users email address. You will have the ability to skip setting up the 2FA process a few times before it becomes required to access the account. We would recommend setting up 2FA on the first log in since you will have eventually set it up anyway.
Once you have entered the emailed security code, you will be presented with the Security Setup page. Here we will select the Authenticator app option and click the Next button.
Using the authenticator app option has been the simplest and quickest way to get multiple users setup with 2FA. NetSuite will provide you with a three-step process page, which contains a QR code. Scan the QR code with an authenticator app of your choice and enter the number generated by the app to verify your primary 2FA method.
Currently NetSuite supports the following 3rd Party authentication applications:
Users can store the screenshot of QR code in a safe place for any new users that require access to the account via the shared email. If the account is primary for personal use. User can also add phone number as secondary method of 2FA to receive verification code via SMS/Phone Calls for added security.
Once on the backup codes page user can take note of the code physically or via screenshot instead of saving the code in text format to reduce risk of security breach. Please note that one security code can only be used one time. If all security codes have been used, user will have the ability to generate another set of codes.
After 2FA is setup, the user will have to enter the verification code on their next login via the interface shown below. To login with a highly privileged role, a user must enter the 6-digit code from authenticator before the timer runs out. If a mobile phone is added as a method for a 2FA user, they can enter the code received by SMS before it expires (one minute). As an alternative, the user can enter the 8-digit backup code after clicking on the backup codes button shown in the top right corner of the login screen.
This rarely happens, but in the case of switching to a new phone, changing the number or running out of backup codes, a NetSuite user can reset their 2FA Setting/Backup Codes after logged into NetSuite by navigating to the Settings portlet located on the home dashboard.
Users can do one of the following:
For NetSuite Solution Providers and integration accounts, it is likely that one access (for example xxxxx@techfino.com) might be used by multiple people for administration. In this scenario, users have the following options:
We must mention that shared access will dramatically increase the chance of security breach. Avoid shared access when possible.
We like to use LastPass to store credentials. It is a free and safe application. User can store all credentials in one place and use it across multiple browsers once the desktop version is installed. It can store multiple credentials for one site vs Google Chrome’s one credential only for one domain. It is also possible to share credentials without exposing the password.
There is also a way to share 2FA verification (to avoid 2FA setup headache)