Community News

 View Only
Join the Zuora AI group to discover use cases, stay ahead of updates, and see AI in action
Back to discussions
Expand all | Collapse all

Moving to Authenticator App–Based MFA for Stronger Security

  • 1.  Moving to Authenticator App–Based MFA for Stronger Security

    Posted yesterday

    Overview


    To enhance account security and better protect customer data, we are updating our multi-factor authentication (MFA) policy.

    By June 30, 2026, we will transition from SMS-based MFA to authenticator app–based MFA as the standard authentication method for users who log in directly to Zuora.

    What's Changing

    As part of this update:

    • SMS-based MFA will be deprecated and removed

    • Authenticator app–based MFA (such as Google Authenticator or Microsoft Authenticator) will become the required method

    • SMS-based MFA will be fully disabled by June 30, 2026.

    Why We're Making This Change

    While SMS-based MFA has been widely used, it is more vulnerable to security risks such as SIM swapping and message interception.

    Authenticator apps provide a more secure and reliable alternative by offering:

    • Stronger protection against account takeover

    • Secure, device-based authentication

    • Greater reliability without dependence on SMS delivery

    • Alignment with modern security best practices

    This update helps ensure a stronger security posture across all customer environments.

    What You Need to Do

    No immediate action is required at this time.

    After the transition period, users who log in directly with Zuora credentials (non-SSO users) will be required to reconfigure MFA using an authenticator app.

    When you log in after the effective date:

    1. You will be prompted to set up MFA

    2. Follow the steps to configure an authenticator app (e.g., Google Authenticator, Microsoft Authenticator)

    3. Verify the setup to complete your login

    To prepare for this change, we recommend installing an authenticator app on your device in advance.

    Using Single Sign-On (SSO)?

    If your organization uses Single Sign-On (SSO), no action is required. MFA will continue to be managed by your identity provider (IdP).

    This change applies only to users who authenticate directly with Zuora (non-SSO users).

    What Happens After the Jun 30, 2026 deadline

    Once this change takes effect:

    • SMS-based MFA will no longer be available

    • Non-SSO users will be required to enroll in authenticator app–based MFA before accessing their accounts

    Need Help?

    If you need assistance setting up an authenticator app, please contact our support team or refer to the product documentation Center for guidance.



    ------------------------------
    Bharath Marimuthu
    Zuora, Inc.
    ------------------------------