Configure Customer TFA
Open Stores > Configuration > MageB2B > Customer Two-Factor Authentication > Two-Factor Authentication. Configure the intended website or store scope before inviting customers to enroll.
Roll out optional TFA first
A cautious rollout starts with:
| Setting | Suggested starting value |
|---|---|
| Enable TFA for Customers | Yes |
| Mandatory TFA for Customers | No |
| Disable TFA During Admin Login as Customer | Yes, if support uses impersonation |
| Issuer Name | The recognizable store or company name |
| Recovery Codes Count | 10 |
| Setup Secret Lifetime | 600 seconds |
| Maximum Verification Attempts | 5 |
| Recovery Code Regeneration Authentication | Current TFA Code |
Enroll a staging customer, use a recovery code once, regenerate codes and test an Admin reset. Make TFA mandatory only after customer communication and support recovery are ready.
Setting reference
Enable TFA for Customers
Turns the storefront feature on for the current scope. Existing enrolled data remains stored when the feature is switched off, but the login challenge and account controls are inactive.
Mandatory TFA for Customers
Customers without TFA must complete enrollment after their password is accepted. Logged-in customers without enrollment are redirected from other account pages to setup. An enrolled customer cannot disable TFA while this setting is active.
Disable TFA During Admin Login as Customer
When enabled, a session created through Magento's Login as Customer workflow bypasses customer TFA. This is convenient for support, but the administrator can then enter the customer's account without the customer's authenticator.
Leave the bypass disabled when impersonated sessions must follow the customer's TFA policy. Test your support workflow either way.
Issuer Name
This is the name shown in the customer's authenticator app. Installation initially uses the configured store-information name when one is available; otherwise the fallback is Customer Account. Use a short name customers recognize.
Changing the issuer changes how newly scanned entries are labelled. It does not rotate secrets already stored for customers.
Recovery Codes Count
Controls how many ten-character, one-time codes are created during enrollment or regeneration. The default is 10. Generating a new set invalidates the previous set.
Setup Secret Lifetime
Controls how long the generated setup QR code and secret remain valid, in seconds. The default is 600. After expiry, the customer must reload setup, scan the new QR code and verify again.
Maximum Verification Attempts
Controls how many invalid codes a pending login can submit. The default is 5. Once the limit is reached, Magento cancels the pending TFA login and sends the customer back to the normal sign-in page.
This is a per-login challenge limit, not a permanent customer-account lock.
Recovery Code Regeneration Authentication
Choose what an already signed-in customer must provide before replacing the recovery-code set:
- Current TFA Code verifies the authenticator the account is using.
- Current Password verifies the Magento customer password.
Disabling optional TFA always requires the current customer password, regardless of this setting.
Admin permissions
Grant Reset Customer Two-Factor Authentication only to support roles that handle account recovery. Configuration access uses the separate Customer TFA configuration ACL.
The extension logs enable, disable and Admin reset events with Magento's standard logger. It does not log authenticator secrets or recovery-code values.