Permissions Requiring Two-Factor Authentication in NetSuite

Starting in NetSuite 2018.2, two-factor authentication (2FA) is mandated for all accounts concerning specific administrative permissions. This requirement is substantial as it brings an added layer of security to sensitive operations within NetSuite.

Which Permissions Require 2FA?

The administrative permissions that necessitate 2FA include:

• Access Token Management (for Token-based Authentication)
• OAuth 2.0 Authorized Applications Management
• Core Administration Permissions (see more about Core Administration Permissions)
• Two-Factor Authentication base permission, which allows roles to be designated as requiring 2FA and to set durations for trusted devices for those roles
  Standard roles with the 2FA base permission include:
  • Marketing Administrator
  • Sales Administrator
  • Support Administrator
  • System Administrator
• Set Up OpenID Connect (OIDC) Single Sign-on
• Set Up OpenID Single Sign-on
• Set Up SAML Single Sign-on
• OIDC Provider Setup
• Integration Application
• Device ID Management
• View Unencrypted Credit Cards
• View Unencrypted ACH Account Numbers

Important Notes

• If a role is configured as a SAML Single Sign-on (SSO) role, the requirement for 2FA is not applicable, as SAML SSO requirements take precedence.
• All non-UI API access, such as through web services or RESTlets, will also require 2FA. Roles that require 2FA cannot authenticate using user credentials for API access.

This initiative not only safeguards sensitive data but also ensures compliance with modern security protocols.

Related Resources

• More on Two-Factor Authentication (2FA)
• 2FA in the NetSuite Application
• NetSuite Roles Overview
• NetSuite Account Administration

These resources can further enhance your understanding of how to effectively manage roles and permissions in NetSuite, making your organization more secure and compliant with best practices in authentication.