Managing Your Company's Login Settings

BambooHR prioritizes data security and offers various authentication options for user access. Users can manage settings through the "Settings > Account > Login Settings" menu, where they can configure Single Sign-On (SSO), 2-Step Login, Passkeys, and Mobile App QR Code Login. SSO allows users to log in using third-party accounts, while 2-Step Login adds an extra security layer by requiring a verification code. Passkeys enable password-free login through device security features. The Mobile App QR Code Login facilitates quick access without manual entry. Users experiencing login issues can refer to the Login Troubleshooting guide. Additional resources include articles on setting up 2-Step Login and using passkeys. For further assistance, users can contact Customer Support.

  • Jul 8, 2026
  • Knowledge

Title
Managing Your Company's Login Settings
Article Text
This feature is included in the Core, Pro, and Elite packages.

Data security is our top priority at BambooHR. Because your BambooHR account stores sensitive employee data, it is essential to manage how users (both employees and non-employee users) securely access their accounts. 

From Settings > Account > Login Settings, you can configure all authentication options in one place, including single sign-on (SSO), 2-Step Login, Passkeys, and Mobile App QR Code Login. 

Expand AllCollapse All

Table of Contents

Can't log in? We're here to help. If you or another user are having trouble signing in to BambooHR, check out our Login Troubleshooting guide for quick solutions to the common login issues.

Accessing Login Settings

  1. In BambooHR, go to Settings.
  2. Select Account from the left navigation menu.
  3. Click Login Settings. The Login Settings page will show all available login options for your company.
Single Sign-On (SSO)

You can install or manage your SSO integration from Settings > Apps in BambooHR.

Single Sign-On (SSO) allows employees to sign in to their BambooHR accounts using a third-party account, such as Google Single Sign-On, OneLogin, Okta, etc.

If your company has enabled SSO, users log in through your SSO provider rather than relying solely on BambooHR credentials. Depending on your company's SSO configuration, there are two possible login experiences:

  1. SSO only: Users log in directly through your SSO provider; no email or password required. These users do not need to complete 2-Step Login since verification occurs entirely through your SSO provider.
  2. SSO with optional email and password: Users can still sign in using their email and password or a passkey. These users must complete 2-Step Login because part of their authentication occurs within BambooHR.
2-Step Login
2-Step Login

2-Step Login adds an extra layer of security for your users' BambooHR accounts. When enabled or required, users signing in with an email and password must also enter a verification code sent by text message or generated by an authenticator app.

  1. If a user cannot log in because they no longer have access to their 2-Step verification method (e.g., changed their phone number, deleted their authentication app, or the text authentications aren't coming through), you can reset their 2-Step Login to help them regain access. Click here to learn how.
  2. Depending on how your login settings are configured, you may have the option to edit 2-Step Login settings, such as making it optional, required for all, or required by access level.

The Set Up Your 2-Step Login guide includes more information on how users can set up their verification methods.

How 2-Step Login works

  • 2-Step Login is required when signing in with an email and password.
  • 2-Step Login is not required if your company uses SSO exclusively or if a user signs in with a passkey because each method already verifies identity securely—through your SSO provider or the user's device. Review the table below to learn more.
  • Users can trust their device for six months to reduce repeated verification methods. After six months or when signing in from a new device, verification is required again.

If a user cannot log in due to 2-Step Login issues, you can reset their 2-Step Login. For step-by-step instructions, visit our Reset a User's 2-Step Login help guide.

Third-party login users

Depending on how your company signs in, not every user needs to set up 2-Step Login.

Login Setup2-Step Login Required?
BambooHR username and password YES
SAML, SSO, Google/Microsoft Login without BambooHR username and password loginNO
SAML, SSO, Google/Microsoft Login with BambooHR username and password loginYES—users logging in with their BambooHR credentials will still need a verification code

To confirm which users have enabled 2-Step Login and their selected verification method, check the 2-Step Login Configuration report.

FAQ

  1. Will your 2-Step Login requirement override users' third-party MFA login?
    • No. If all users already use SSO/SAML or another multifactor authentication provider, BambooHR's 2-Step Login will not apply.
  2. How is the 2-Step Login requirement different from the two-step process that is already in place for employees to log in to their account?
    • Users will need to use a mobile device to set up 2-Step Login via SMS or an authenticator app. Once set up, users can choose to trust the device for six months. After the six months, users will need to renew their login.
  3. What if a user does not have a mobile device? What options can they use for 2-Step Login?
    • 2-Step Login requires a phone or authenticator app/browser extension to validate the login. You can consider the option of enabling SSO, which allows for alternative methods of validation.
  4. Are non-employee users required to use 2-Step Login?
    • Yes—unless they log in exclusively through SSO.
  5. Can we disable 2-Step Login?
    • No. Our 2-Step Login requirement is a mandatory security setting to keep your account a secure place for your important data.
  6. Why was this requirement implemented?
    • We decided to implement the 2-Step Login requirement due to some major data breaches and cybersecurity incidents within other companies in 2024. Requiring MFA will reduce customer data risk, internal costs to investigate instances of fraud, and the reputational risk to BambooHR associated with a security incident.

Have additional questions? Please reach out to our Customer Support team.

Passkeys (Preferred Method)

Passkeys provide a password-free login option that uses your device's built-in security, such as a fingerprint, face ID, or PIN. The Passkeys option is enabled automatically if your company uses BambooHR authentication (and not using SSO exclusively) and cannot be disabled. Users do not need to use 2-Step Login if they set up a passkey to log in.

Some browsers may not support passkeys. However, most modern browsers do.

Users can view and manage their own passkeys under Account Settings > Passkeys in BambooHR and in the BambooHR mobile app.  

Removing passkeys

Account Owners and Full Admins can remove a user's passkeys by default. Admins typically remove passkeys when a device is replaced, a user's access changes, or troubleshooting a login issue. Custom access level users can remove passkeys if they have Reset User Passwords & Remove Passkeys enabled (see above).

Passkeys can be removed from two locations in BambooHR:

  1. The user's employee profile (not applicable for non-employee users)
  2. The user's row in Settings > Access Levels
Mobile App QR Code Login

Mobile App QR Code Login lets users quickly access the BambooHR mobile app without manually entering their email and password.

When this option is enabled, users can log in to the mobile app by scanning a secure QR code that appears after signing in on desktop.

URL Name
1327977