BambooHR 2FA: how to set up an authenticator app for 2-Step Login

BambooHR is the HR system many employers use for pay stubs, time off, benefits and your employee record. Its two-factor authentication is called 2-Step Login, and it isn't something you can switch on alone: your company's BambooHR admin decides whether it's offered, optional or required. Once it is, BambooHR asks for a code from an authenticator app on top of your password. Text messages and recovery codes exist too, but BambooHR now presents them as backups and puts the authenticator app first (BambooHR). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way, and BambooHR's help says the same.

How we checked this guide: the BambooHR steps come from BambooHR's own product updates and help center, linked below, which we read on October 21, 2026. The help center articles now load only with JavaScript, so we read archived copies of their earlier versions on web.archive.org, saved in March and June 2023. BambooHR has simplified the setup screens since then, so labels may differ. We haven't tested the steps on a BambooHR account. The Novaz steps are checked against the app, version 1.0.5.

First, your admin has to turn it on

An admin enables 2-Step Login under Account in Settings: select 2-Step Login, then Get Started, and pick one of three levels (BambooHR):

• Enabled For All: anyone can opt in, nobody has to.
• Require For All: everyone must use it from a start date the admin picks.
• Required By Access Level: only some access levels must use it, and others can still opt in.

BambooHR added the opt-in choice and text messages later, as an update to this same setting (BambooHR). If your company uses BambooHR Payroll and you sign in with a BambooHR username and password, BambooHR's 2023 page says 2-Step Login is required (BambooHR).

Turn on 2FA with an authenticator app

You have to do this in a web browser, ideally on a computer. BambooHR's mobile app can't set it up, though it asks for codes afterwards (BambooHR).

1. Sign in to your company's BambooHR site. If 2-Step Login is required or coming, a notice tells you the date. Choose to set it up now, or Not Yet to put it off until that date.
2. Pick the authenticator app as your method. It's the preselected choice in the current setup (BambooHR).
3. BambooHR shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
4. If you're setting up on your iPhone's own browser, BambooHR says you can't scan the code and offers Enter Code Manually instead. Its 2023 page describes that key as 10 characters long. Novaz needs a typed key of at least 16 characters, so a key that short won't work by hand. Take a screenshot of the QR code and add it in Novaz with +, then Choose a photo. See scanning a QR code on the same iPhone. If BambooHR shows you a longer key, you can type it with +, then Enter key manually, as the Setup key.
5. Type the 6-digit code from Novaz into BambooHR. BambooHR's codes change every 30 seconds. Check the box if you want BambooHR to remember this computer for 30 days, then select Next.

If your company's admin chose Enabled For All, BambooHR's pages we could read don't say where in your own account you opt in.

Add recovery codes as a backup

In 2023, BambooHR showed backup codes right after setup, to download or print. In the current flow, recovery codes and text messages sit behind Add a backup method, so you have to go looking for them (BambooHR). Do it. If the phone is gone and you have no Novaz backup, these codes are what get you in.

Each code works once and is crossed out after use. You can generate new ones if you lose them or think someone has seen them. BambooHR's 2023 page puts them under your avatar, at View 2-Step Login Backup Codes (BambooHR). More in 2FA backup codes.

When BambooHR asks for a code

Every sign-in, unless you ticked the box to remember the computer, which lasts 30 days. A different computer or browser needs a fresh code, and so does the mobile app once you've set up 2-Step Login (BambooHR).

If BambooHR rejects your code

Go slowly: BambooHR locks you out for 30 minutes after too many wrong codes (BambooHR). Most rejected codes come from the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

New phone or lost phone

BambooHR doesn't describe a way to move 2-Step Login to a new phone yourself. With Novaz, you can restore your accounts on the new iPhone from iCloud backup or a backup file (moving to a new iPhone). Without one, what BambooHR offers is a reset by your company:

• An admin can reset you from the 2-Step Login settings, or from your employee profile under Security, then Reset 2-Step Login (BambooHR).
• Admins can also give that power to custom access levels, for employees who need to change their verification method (BambooHR).

So if you lose your phone, use a recovery code, then ask your HR team for a reset. If you're an admin and locked out yourself, BambooHR's 2023 page lists three routes in order: another admin resets you, you use your backup codes, or you call BambooHR Support, which needs written approval from a Full Admin. It doesn't say how long that takes. See also Lost the phone with your authenticator app?

Turning it off

Only an admin can, for the whole company, from the same 2-Step Login settings. Employees can then sign in without a code at once. If the admin turns it back on later, people's earlier setups still work (BambooHR).

Official BambooHR help

• 2-Step Login (product update)
• Simplified 2-Step Setup (product update)
• 2-Step Login enablement for all users (product update)
• Access Levels for MFA Reset (product update)
• Set Up Your 2-Step Login (read in an archived copy from March 2023, then titled "2-Step Login Setup")
• 2-Step Login, for admins (read in an archived copy from June 2023)