If you are experiencing login issues, please refer to this section of this guide as it provides comprehensive solutions to help you regain access.

Multifactor authentication (MFA), also called two-step login or two-factor authentication (2FA), adds an extra layer of security to your BambooHR account. MFA prevents unauthorized access, even if someone learns your password, because they cannot log in without your unique verification code.

BambooHR's 2-Step Login requires two forms of verification to confirm your identity:

• Something you know: Your password
• Something you have: A device or app that provides a one-time code

The second step can come from the following:

• A time-based verification code generated by an authenticator app (recommended)
• An SMS text message sent to your phone number

You will also receive backup recovery codes, which act as a fallback if you lose access to your phone or authenticator app. Each backup code can be used once and should be stored securely.

BambooHR takes your account security seriously. The new browser email notification is designed to help you verify that it is really you signing in. It also provides greater visibility into your account activity and helps protect your data.

It is sent any time you log in from a new or unrecognized browser or device. Only you, as the account user, will receive this email, and it includes details such as the time zone and country of origin for the login attempt.

By clicking Yes, Trust This Browser, you can successfully log in and will not receive email notifications for future logins from this browser. However, you might still receive this email in the following cases:

• You signed in from a different browser or device.
• You cleared cookies or cache since your last login.
• You used incognito/private browsing mode.
• You are connected to a VPN that masks your location.

Users are locked out after five incorrect password attempts for 30 minutes. This is a standard security practice to prevent brute force password attacks. Here's what to do:

1. Wait 30 minutes, then try logging in again.
2. If you still need to reset your password, click Forgot Password? on the login page to get a password reset email. There is no restriction on using a previously used password when updating it.
3. Double-check that you are using the correct email address and login URL for your company.
4. If you continue to have issues, contact your administrator for assistance.

SMS codes are valid for 10 minutes. If you do not receive your code within five minutes, click Resend Code and confirm that your phone number is correct on your employee profile.

BambooHR completely logs you out of your account after 30 minutes of inactivity. After 10 minutes of inactivity, the screen will be grayed out, and you will be required to enter your password to return to the same page you were on. These logout time frames are in line with security best practices.

To keep the session active, click on a link or refresh the page every 30 minutes or less. Moving your mouse around does not count as activity on the page.

The issue can occur for two different reasons, depending on whether your company uses single sign-on (SSO) or logs in directly through BambooHR.

If your company uses SSO, employees should sign in through their company's SSO provider or by selecting Log in with [SSO Provider] on the BambooHR login page. If you reset your BambooHR password while the SSO is enabled, the system allows one traditional login as a backup measure in case the SSO integration is temporarily disabled. After that, continue to log in to your BambooHR account using SSO.

If your company does not use SSO, repeated password resets are usually caused by mismatched login information or browser settings, including the following:

• Using an incorrect company login URL
• Entering an email address that does not match what is listed in your BambooHR employee profile.
• A browser autofill setting entering an old or incorrect password.

To fix this, clear your browser's cache and cookies, confirm your company's login page, and enter your credentials manually.

If none of the above options work, please contact your HR administrator.

To log out of BambooHR, click your profile picture in the bottom left corner, then click Log Out.

To ensure the highest level of data protection, BambooHR requires mandatory multifactor authentication, also known as 2-Step Login, for all users. This helps keep your company's data safe by adding a second layer of security when logging in.

As of December 2, 2024, 2-Step Login is required for all users, including administrators and employees, unless your organization uses SSO exclusively. Click here to learn more about the SSO exception.

You can view this information in the 2-Step Login Configuration report. This report lists all active employees and shows whether they have enabled 2-Step Login, as well as which verification method(s) they are using (SMS and/or authenticator app).

Full Admins can share this report with others. However, anyone viewing the report will only see the employee details permitted by their assigned access level.

Account Owners and Full Admin users can can reset a user's 2-Step Login for employees, and non-employee users, and other administrators. For step-by-step instructions, review the Reset a User's 2-Step Login guide.

You can also grant custom access level users permission to reset password and 2-Step Login for these users. This allows designated team members, such as HR or IT staff, to assist others without requiring full admin access.

The timing of the Create Your Account or Welcome to [Company Name] email depends on how and when an employee is added to the system, their hire date, and their access level.

Only an Account Owner or Full Admin can request that an SSO or SAML integration be removed from your BambooHR account.

If you are an admin and need to uninstall the integration company-wide, please contact our Customer Support team and include written approval with your request.

This can happen for a few different reasons, some of which may be outside of our control. For example, the mobile carrier is not allowing the text message to be delivered. If SMS verification is not working, the best next step is to use an authenticator app to complete the 2-Step Login setup. Authenticator apps are generally more secure than SMS messaging.

This can happen due to one of the following reasons:

1. If the user has already had their 2-Step Login reset, they will not appear in the dropdown list until they have authenticated their new login.
2. If a user does not have 2-Step Login enabled, they will not appear in the dropdown list.

Data security is our top priority at BambooHR. Our 2-Step Login (MFA) requires a verification method such as text message (SMS) or an authenticator app for accounts that do not already use a third-party MFA solution. If a user does not have access to a mobile device or is not allowed to use one at work, you can consider enabling single sign-on (SSO), which does not require the use of a mobile device. You can also explore alternative MFA options that connect with BambooHR, such as Google SSO or Microsoft SSO.

No. Users' email accounts serve as the first line of defense that protects their passwords. For example, when users reset their password, they receive a password reset email. Because email is already part of that first layer of security, it cannot also serve as the second.

This second step must come from a separate verification method to add another layer of security. The authentication methods that currently exist include text message (SMS) or an authenticator app, which can be downloaded on a mobile device, downloaded to a computer, or accessed in a browser.

BambooHR's 2-Step Login supports text message (SMS) and authenticator apps to verify a user's identity and prevent unauthorized access. Click here to learn more.

Please first confirm that you have completed these steps to access the Help Center:

1. Log in to your BambooHR account.
2. Click the question mark icon (?) in the top right corner of your account.
3. Select Help Center, then choose any help guide.
4. If it is your first time access the Help Center, you will need to verify your email address. Once verified, you will gain access to the Help Center.

If you are still unable to log in or are stuck in a loop returning to the Home tab, try these additional troubleshooting steps before contacting BambooHR Customer Support.

• Try a different browser. We recommend Google Chrome and Firefox, not Safari or Internet Explorer/Edge.
• Clear your browser's cache and cookies.
• Check your browser extensions to see if there are any ad blockers enabled. Adding BambooHR to the allowed list for pop-ups in browser settings resolves this issue in most cases.

After completing these steps, you should be able to access the Help Center. If the login issue still persists, please contact our Customer Support team for further assistance.