Multi-Factor Authentication is available on every Buddy Punch account as of September 3, 2026. It’s no longer limited to accounts using Buddy Punch Payroll.

Limits worth knowing

Multi-Factor Authentication applies when signing in to the web app. The mobile apps don’t currently prompt for it.

Users on accounts with Buddy Punch Payroll are always required to use MFA, whatever the account-wide policy is set to.

Where SSO is enforced, your identity provider handles sign-in, so Buddy Punch hides MFA enrollment for those users rather than asking for a second factor on top.

Set your account-wide policy to off, optional, or required

You control Multi-Factor Authentication (MFA) for the whole account with an account-wide policy and a per-user reset that clears someone’s existing method so they can start again. Set the policy in “Settings” → “Account Settings,” in the Multi-Factor Authentication section at the bottom of the page. See the setup steps for multi-factor authentication for how to change it.

Optional is the default. Users can set up multi-factor authentication if they choose. A user who hasn’t enrolled can keep logging in with just their password.

Off means multi-factor authentication is not required. New users aren’t prompted to set it up, and anyone already enrolled keeps it and is still prompted at login until they remove it themselves.

Required means every user must set up multi-factor authentication to sign in to the web app, apart from users where SSO is enforced. If you want your employees to sign in with a second step, set the policy to “Required” so anyone who hasn’t set it up is sent to do so at their next login and can’t skip that step.

What employees see

On the required setup screen, users can still log off, but they can’t reach the rest of Buddy Punch until they’ve enrolled.

New MFA setups offer an authenticator app or a passkey. Only users who already had text message codes set up can keep using them.

If a user ticks “Remember this browser?” on the verification screen, that browser won’t ask again for 14 days.

Resetting a user

To reset one user, go to “Employees,” then “View” next to the user, then the “More” dropdown on their profile, then “Reset MFA.” The reset option only shows for users who currently have Multi-Factor Authentication set up.

Resetting clears the user’s existing authenticator app and passkeys. They keep their username and password, and are asked to set Multi-Factor Authentication up again the next time they log in.

The user is automatically emailed to let them know.

Our support team can help if you have questions about the policy or a user’s MFA.