What this is
2FA (Two-Factor Authentication) adds an extra verification step during login to prevent unauthorized access and reduce account sharing.
For administrators, this is a control point between security and operational flexibility.
When you should use 2FA
Enable 2FA when you need:
Reliable Audit Trail (who did what)
Prevention of shared operator accounts
Compliance with regulated environments (ISO, FDA, etc.)
Protection against credential-based attacks
👉 Without 2FA, a password = full access
👉 With 2FA, access is tied to a real person
How to enable or disable 2FA (system level)
Go to Settings → System
Find Email Two-Factor Authentication
Toggle Enable Email 2FA
Set Hours Between Challenges
Default: 168 hours (7 days)
Click Save
💡 This controls the behavior for all users
When to bypass 2FA (important)
There are real scenarios where 2FA does not fit:
Shared workstations / shop-floor terminals
Users without real email access
System / integration users
For these cases:
Go to Settings → Users
Open the user
Enable Bypass Email 2FA
Save
⚠️ Important:
Bypassing reduces traceability and security. Use only when necessary.
Smart system behavior
Next Plus is designed not to block production:
SAML users → handled externally (2FA skipped)
API users → always skipped
SMTP not configured → login is NOT blocked
Bypass enabled users → skip verification
👉 Security is enforced — but operations always continue
How to think about 2FA (recommended approach)
Don’t treat 2FA as a “security feature”.
Think of it as:
👉 A way to protect the integrity of your production data
Because in Next Plus:
Data = decisions
Decisions = production outcomes
If identity is weak → everything downstream is weaker
Common Issues / FAQs
Users complain about friction
Reduce challenge frequency (increase hours)
Keep default (7 days) for balance
Users don’t receive emails
Check SMTP configuration
Verify user email addresses
Too many shared users
Don’t bypass — fix the user structure instead