Setting Up Email Two-Factor Authentication (2FA) in SIX ERP

Email Two-Factor Authentication adds an extra security step to your login: after entering your username and password, you must confirm a one-time code sent to your email. This helps protect your account even if your password is known by someone else.

This article explains how users and administrators can enable Email 2FA, and what to watch out for to avoid lockouts.

1. Who can enable Email 2FA?

There are two ways Email Two-Factor Authentication can be enabled:

Administrator-controlled
- An administrator can enable or disable Email 2FA for any user.
- This is typically used in organizations that enforce 2FA as a policy.
User self-service
- If Email 2FA is not enabled by default, and your access configuration allows it, you can enable Email 2FA yourself in your user profile.

In most cases, users are allowed to edit their own account and preferences.
However, this may depend on your Access Configuration. If you cannot edit your profile, contact your administrator.

2. Requirements before enabling Email 2FA

Before you turn on Email Two-Factor Authentication, make sure:

You can receive emails from your SIX ERP system (check spam filters, whitelists, etc.).
You have access to the mailbox linked to your SIX ERP user account at all times.
Your email address in the system is correct and up to date.

⚠️ Important: If your email account is not accessible (e.g. mailbox disabled, wrong email, no access), you will not be able to complete the login once Email 2FA is enabled. This will result in a system lockout, and only an administrator can help you regain access.

3. Self-enabling Email 2FA as a user

You can reach the Email 2FA setting in two ways:
via HR → Staff Management or via your profile image in the left menu.

3.1 Open your user profile

Option A: Via HR → Staff Management

In the main menu, go to:
HR → Staff Management
In the staff list, locate and select your own account.

Option B: Via your profile image

In the left menu, click on your account image (avatar).
In the pop-over that appears, select Full User Profile.

Both paths should bring you to your User Profile page.

3.2 Switch to edit mode

On the User Profile page:

Click the Edit button.

If you cannot see the Edit button or you get an error when clicking it, your Access Configuration may prevent self-editing. In that case, contact your administrator and ask them to enable Email Two-Factor Authentication for you.

3.3 Enable Email Two-Factor Authentication

Once you are in editing mode on your user profile:

Locate the checkbox labeled:
Enable Email Two Factor Authentication
Tick the checkbox to enable Email 2FA for your account.

After ticking the checkbox, click SAVE to apply the change.

If the save is successful, Email 2FA is now activated for your next login.

4. Administrator: enabling/disabling Email 2FA for a user

Administrators can manage Email 2FA for any user using the same profile screen, but accessed via HR:

Go to HR → Staff Management.
Select the user account you want to configure.
Click Edit in the user profile.
Locate the checkbox Enable Email Two Factor Authentication:
- Tick it to enable Email 2FA for the user.
- Untick it to disable Email 2FA for the user.
Click SAVE.

This is also the procedure to follow if a user has lost access to their email inbox and needs Email 2FA disabled or another method activated.

After Email Two-Factor Authentication is enabled (either by you or an administrator):

Go to the SIX ERP login screen.
Enter your username and password as usual.
If credentials are correct, instead of logging you in immediately, SIX ERP will:
- Show a Two-Factor Authentication screen, and
- Send an email containing a 6-digit passcode to your configured email address.
Open your email inbox and find the message from SIX ERP with the code.
Enter the 6-digit passcode into the 2FA screen.
Confirm/submit the code. If valid, you will be logged in successfully.

If the code is incorrect, expired, or the email never arrives, you may need to:

Retry login to generate a new code.
Check spam/junk folders.
Verify that you’re checking the correct email account.
Contact your administrator if you suspect your email address or access is incorrect.

6. Lockout scenarios and recovery

Because Email 2FA depends fully on your ability to receive email:

If your email account becomes inaccessible (e.g. mailbox disabled, password lost, company email deactivated), you cannot complete the second step of login.
This will result in a system lockout for that user.

In such a case:

Only an administrator can:
- Disable Email 2FA for your account, or
- Enable another 2FA method (e.g. Authenticator App, WhatsApp/Viber) on your behalf.

Users themselves cannot bypass or disable Email 2FA once they are locked out.