Is Two Factor Authentication mandatory for users in BrightPay (cloud)?

Two Factor Authentication (2FA/MFA) is now Mandatory for all Team Members. 

• It is now compulsory at the Organisation level
• If 2FA has not been enabled for team members by the account owner or administrator, it will be automatically switched on by the BrightPay development team.
• The default method that will be enabled is Email.

If a user is already using one of Bright’s products such as Connect, BrightManager, BrightBooks or BrightPropose and has Two Factor Authentication enabled for these products, when the user logs into BrightPay (cloud) for the first time, they will be asked for the code to verify by whatever option they have set up in BrightHub to receive the code.
If no method is already set up, the code will be sent by email to the user by default.

Two Factor Authentication is mandatory for users in BrightPay (cloud)

Once you are signed into BrightPay (cloud), go to:

My Organisations > Select your Organisation > Team Members

If 2FA has not been enabled for team members by the account owner or administrator, it will be automatically switched on by the BrightPay development team.

If 2FA is enabled on an Organisation for team members, what method do they use for the verification code by default?

If 2FA is enabled on an Organisation, when any team member of that Organisation tries to log into BrightPay (cloud), the verification code will be sent by email to the team member by default (unless they have chosen another method in their Bright ID).

Can a user set up 2FA for their own Bright ID?

Yes, this can be done on the user’s profile.

1. Select the icon in the top right-hand corner of the screen.
2. Select Manage My Bright ID.
3. Select the Security tab.
4. Choose Manage 2FA.

You can choose your preferred 2FA method:

• Authentication App
• Text
• Email

If you select Authentication App or Email, you can select Save.

If you select Text message, you need to enter your phone number and select Continue.
A verification code will be sent to your phone by text. You will need to enter this in the field provided and select Continue.
Your phone number is then verified, so the next time you log in you will be required to enter a code that is sent via SMS to your phone.

When you log into BrightPay the next time, you will see:

• If Authentication App is your method: Enter the verification code from your authenticator app.
• If Text message is your method: “Your BrightID is protected with two-factor authentication. You must enter a verification code that is sent to your phone.”
• If Email is your method: You must enter a verification code that is sent to your email address.

Which is the strongest method to use for 2FA?

The authentication app is the strongest and preferred method, followed by text message, then email.

What authentication app can we use?

We recommend using the Microsoft Authenticator app, but you can also use Google Authenticator or Authy.

If a user is a member on multiple Organisations and 2FA is enabled on only one of the Organisations, what happens?

2FA is now mandatory for Team Members, they will always be required to complete 2FA when signing in.

Can 2FA be turned off for individual users?

No, 2FA is mandatory for Team Members in an Organisation, it cannot be turned off for them.

If a customer only wants certain members on their Organisation to have 2FA enabled, can this be done?

2FA is mandatory for Team Members in an Organisation. If it was not enabled manually, it will be automatically enabled using Email as the default method.

How do I reset the 2FA on the account if I cannot access my Bright ID or I am locked out?

Please email brightpayonlineiresupport@brightsg.com and provide the following details (for GDPR purposes):

• Employee account – Please contact your payroll processor or manager and ask them to email our support team confirming that you’d like your 2FA to be reset.
• Manager Account – Please contact your payroll processor and ask them to email our support team confirming that you’d like your 2FA to be reset.
• User Account (Client Portal) – Please contact your payroll processor and ask them to email our support team confirming that you’d like your 2FA to be reset.
• Team Member (Admin/Payroll processor) – Please contact another Admin on the account and ask them to email our support team confirming that you’d like your 2FA to be reset.
  • If there is no other Admin or Owner on the account, we will need an email sent to us from the CEO or Business Owner giving their permission for this to be done.

Note: To change the 2FA method once set, please select the profile icon in the top right-hand corner and select Manage My Bright ID.

Under the Security tab, select 2FA Settings. Then choose the new 2FA method that you would prefer from the three options available and Save the settings.

I no longer have access to my 2FA phone number. How do I regain access to my account?

If you can’t access the phone number registered for two-factor authentication (2FA):

1. You won’t be able to remove or bypass 2FA yourself without access to the registered phone number.
2. Please contact BrightPay Support by email or phone. After we verify your identity, we can switch your 2FA from your phone number back to your email.

3. To verify your identity, you will be asked to provide:

   • The account email address
   • Your company name
   • Billing details (e.g. last 4 digits of card, recent invoice number, or other agreed‑upon details)
    
4. Once your identity is confirmed, Support will update your 2FA so you can log in and set it up again with a new phone number.
5. If your request is urgent (for example, you need to run payroll today), please call Support so we can prioritise your case.