1. Is Two Factor Authentication mandatory for employees in BrightPay?

For the moment, Two Factor Authentication (2FA/MFA) is optional.

• It can be made compulsory at the Employer level, or
• An individual employee can enable Two Factor Authentication for their own Bright ID

If an employee is already using one of Bright’s products such as BrightManager, BrightBooks, or BrightPropose and has Two Factor Authentication enabled for these products, then when the employee logs into the BrightPay Employee Self Service Portal for the first time, they will be asked for the code via whatever option they have set up in BrightHub to receive the code.
If they do not already have a method set up, the code will be sent by email to the user by default.

2. How does an employer enable Two Factor Authentication for employees in BrightPay?

To enable Two Factor Authentication on an Employer in BrightPay:

1. Sign into BrightPay.
2. Open the employer.
3. Go to Employer > Employee Portal > Settings.
4. Select Require Two Factor Authentication.
5. Click Save.

3. What type of team members on an Organisation can enable Two Factor Authentication for all employees on an Employer in BrightPay (Cloud)?

Any team member role with access to the Employer will be able to enable Two Factor Authentication for all employees on that Employer in BrightPay (Cloud).

4. If Two Factor Authentication is enabled on an Employer for employees, what method do they use for the verification code by default?

If Two Factor Authentication is enabled on an Employer, when any employee of that employer tries to log into BrightPay's Employee Self Service Portal, the verification code will be sent by email to the employee by default (unless they have chosen a different method in their Bright ID security settings).

5. Can an employee set up Two Factor Authentication for their own Bright ID?

Yes. This can be done on the employee’s Bright ID profile:

1. Select the icon in the top right-hand corner of the screen.
2. Choose Manage My Bright ID.
3. Select the Security tab.
4. Click Manage Two Factor Authentication.

Where it displays “To enhance the security of your Bright ID, we strongly recommend enabling Two-Factor Authentication” select On on the right.

You can then choose your preferred Two Factor Authentication method:

• Authentication App
• Email

Select your method and click Save.

When you next log into BrightPay, you will need to verify your identity using the method chosen:

• If Authentication App is your method: Enter the verification code from your authenticator app.
• If Email is your method: Enter the verification code that is sent to your email address.

6. Which is the strongest method to use for 2FA?

The authentication app is the strongest and preferred method, followed by email.

7. What authentication app can we use?

We recommend using the Microsoft Authenticator app, but you can also use Google Authenticator or Authy.

8. Can Two Factor Authentication be turned off for individual employees?

If Two Factor Authentication is enabled on an Employer, all employees in that employer will need to complete the Two Factor Authentication process when logging into BrightPay's Employee Self Service Portal.

9. If an employer only wants certain employees on their employer to have Two Factor Authentication enabled, can this be done?

Currently, if an employer only wants certain employees to have Two Factor Authentication:

• Two Factor Authentication should not be enabled at the Employer level, and
• Individual employees can enable Two Factor Authentication in their Manage My Bright ID area in their profile and select their preferred method for receiving codes.