The quick answer
While you're still signed in, go to Home and click Reset 2FA Settings in the Settings portlet. Type your Current Password and click Reset. NetSuite removes the registered 2FA devices and shows Registered 2FA Devices successfully Removed. Then log out and log in again. Because your role requires 2FA and no device is registered, NetSuite opens Security setup: scan the QR code with the authenticator app on the new phone, type the 6-digit code it shows in Verification code, click Next, and save the 10 backup codes it gives you. If you're already locked out and have no backup code, an administrator has to reset 2FA for you.
Authenticator apps don't always bring their accounts over to a new phone. When that happens, NetSuite still has the old phone registered, and the next time it asks for a code you can't answer it. The example user, Dana Whitcombe, is Controller at Fernhill Outdoor Supply. Her role requires 2FA, her authenticator app came back empty on a new phone, and she's still signed in on her laptop, so she fixes it herself. The people, company, email address, setup key, QR code and codes in the screenshots are all fictional example data.
Before you start
You need to be signed in to NetSuite with your password, and you need the new phone with an authenticator app on it. Any OATH TOTP app works, for example Oracle Mobile Authenticator, Google Authenticator or Microsoft Authenticator. Do the setup in a browser. The NetSuite mobile app can log in with 2FA afterwards, but it can't set 2FA up.
2FA is required per role. An administrator sets it on Setup > Users/Roles > Two-Factor Authentication Roles, and some highly privileged roles, such as Administrator, may always require it. If your role signs in through SAML single sign-on (SSO), the SSO requirement takes the place of NetSuite's 2FA prompt, so follow your identity provider's sign-in and recovery process instead.
If you're already signed out and have neither a code nor a backup code, you can't do this yourself. An administrator, or another user whose role has permission to use it, resets another user's 2FA at Setup > Users/Roles > User Access Reset Tool: they type your login email in Email Address, check Reset 2FA settings and click Save. You then set 2FA up at your next login, the same way as steps 03 to 05 below. The walkthrough shows the self-service reset, not the administrator tool.
01. Check the 2FA links on Home
Open Home. In the Settings portlet, Reset 2FA Settings and Generate 2FA Backup Codes sit right after Manage Passkeys in this account. They show up once a user has 2FA set up, which Dana does, on her old phone. The order of the links around them can differ in your account. If the Settings portlet isn't on your dashboard, add it back through Personalize.
02. Reset your 2FA settings
Click Reset 2FA Settings. The page has Reset and Cancel buttons and one required field, Current Password. Type your NetSuite password and click Reset.
Depending on how recently you verified, the page can also ask for a verification code or a backup code. If the old authenticator is gone, you probably can't produce a verification code, so use a backup code. If you have neither, stop here and ask an administrator to use the User Access Reset Tool.
Home reopens with a Confirmation: Registered 2FA Devices successfully Removed. Reset 2FA Settings and Generate 2FA Backup Codes are gone from Settings, because no device is registered any more. NetSuite also emails you that your registered devices were reset.
Nothing asks for the new phone yet. The reset clears your registered devices and doesn't set anything up. Setup happens the next time you log in to a role that requires 2FA.
03. Log in again
Log out from the menu under your name, then log in with your email address and password. Dana uses dwhitcombe@fernhilloutdoor.com.
Instead of Home, Security setup opens on Two-Factor Authentication with the message "Your administrator requires two-factor authentication for increased security to access this role." The left side lists the two stages, Authenticator app and Backup codes. Step 1 of 2 shows Authenticator app marked SET AS PRIMARY. Install an authenticator app on the new phone if it isn't there yet, then click Next.
Skip to NetSuite postpones setup a limited number of times, and the link shows how many attempts you have left. If you have another role, Choose another role lets you switch to it, though that role may require 2FA too. Neither link removes the requirement from this role.
04. Set up the new authenticator app
Step 2 of 2 opens. Under Step 1. Open the app and scan the QR code, scan the QR code with the authenticator app on the new phone. If the camera can't read it, type the key shown next to it into the app instead. In the example that's KX7R M2QD JTLF 4WNH PZ3C BRVE J6YA. Generate new key replaces the key and the QR code.
The app adds a NetSuite entry with a 6-digit code that changes every 30 seconds. Under Step 2. Verify that your configuration is set up successfully, type the current code in Verification code (418306 in the example) and click Next. If the code rolls over before you submit, type the new one.
05. Save the backup codes and finish
Backup codes shows 10 codes, and the left side now marks Authenticator app as done. Each code works once, and generating a new set later makes the old set stop working. You'll only see these codes here, so copy them somewhere other than the phone, or click Print, before you click Next.
Click Next. Depending on your release, the button can read Continue instead. Home opens, and the Settings portlet lists Reset 2FA Settings and Generate 2FA Backup Codes again.
You're done when:
- Settings on Home lists Reset 2FA Settings and Generate 2FA Backup Codes again;
- the authenticator app on the new phone shows a NetSuite entry;
- your 10 backup codes are stored somewhere other than the phone.
The old phone's authenticator entry no longer works for NetSuite. If you also want to sign out sessions left open on other browsers or devices, see how to check your active NetSuite sessions and sign out the others.
Common questions
What if I'm already locked out?
If you still have a backup code, use it at the 2FA prompt to log in, then reset from Settings as shown above. If you don't, ask an administrator. They go to Setup > Users/Roles > User Access Reset Tool, enter your login email, check Reset 2FA settings and click Save. You set up the new phone at your next login.
Does resetting 2FA move my old authenticator account to the new phone?
No. The reset removes the registered devices from NetSuite and nothing else. You create a fresh NetSuite entry on the new phone by scanning the new QR code, or typing the key, during Security setup.
Which authenticator apps work with NetSuite?
Any app that supports OATH TOTP. The setup page names Oracle Mobile Authenticator, Google Authenticator and Microsoft Authenticator as examples. Scan the QR code, or type the key if the camera won't read it.
What are backup codes, and how many do I get?
You get 10 at the end of setup. Each one works once, and you can use one in place of an authenticator code when the phone isn't at hand. NetSuite shows them only once, so print them or store them away from the phone. Generating a new set later makes the old set stop working.
What does Skip to NetSuite do?
It lets you into NetSuite without finishing setup, a limited number of times. The link shows how many attempts are left, 5 in the example. It doesn't remove the requirement, so once the skips run out you have to finish setup.
Can I set up NetSuite 2FA from the mobile app?
No. The first setup has to happen in a browser. Once it's done, the NetSuite mobile app can log in with 2FA.
Can an administrator reset their own 2FA with the User Access Reset Tool?
No. The tool is for resetting other users. An administrator resets their own 2FA from Reset 2FA Settings on Home while signed in, or asks another administrator to use the tool.