Skip to main content

Two-Factor Authentication for Zuora OneID

Zuora

Two-Factor Authentication for Zuora OneID

  1. Last updated
  2. Save as PDF

Zuora OneID 2FA enhances account security by requiring a second form of authentication in addition to the password. This additional layer ensures that access to the account requires both your password and a verification code sent to your mobile. Two-factor authentication (2FA) enhances security by requiring two forms of verification:

  • A user-chosen password
  • A 6-digit code is sent via SMS to your mobile device

Prerequisites for 2FA

To use two-factor authentication, you must have an SMS-enabled mobile phone.

Set Up Two-Factor Authentication

As a OneID administrator, perform the following steps to set up 2FA for enhanced security:

  1. Log in to the Zuora OneID application as an administrator.
  2. Navigate to your user profile to the right and choose Settings > Security Policies.
  3. Click Edit, choose Enabled in Two Factor Authentication, and click Save.

As a user, perform the following steps to set up SMS authentication:

  1. Log in to the Zuora OneID application. You will be prompted to set up 2FA or SMS-based authentication the first time when you log in after the MFA is enabled and click Continue.
  2. Enter your mobile number after selecting the appropriate country code and click Next.
  3. Click Next and retrieve the authentication code sent to your phone.
  4. Enter the code received within 5 minutes. If it expires, request a new one. Optionally, select Remember me for 30 days to avoid re-entering the code on that machine and browser for 30 days.
  5. Click Next to complete the setup.

Disable Two-Factor Authentication

By default, 2FA is disabled. If you choose to disable it, acknowledge the associated risks, including potential data loss or account compromise. Disable 2FA through your user profile to the right and select Settings > Security Policies by choosing Disabled in Two Factor Authentication and clicking Save.

Change the Mobile Number

To change the registered mobile number for SMS-based MFA, users must contact the Zuora administrator or Zuora support.

Combine SSO and MFA

It is possible to have both SSO and MFA enabled simultaneously. These identity providers can manage MFA for users authenticating through Okta or Azure. SMS-based 2FA will be enforced for users with username and password authentication. Combining SSO and MFA can ensure a higher level of security for user accounts, protecting them from unauthorized access.