Configure Customer TFA

Open Stores > Configuration > MageB2B > Customer Two-Factor Authentication > Two-Factor Authentication. Configure the intended website or store scope before inviting customers to enroll.

Roll out optional TFA first

A cautious rollout starts with:

Enroll a staging customer, use a recovery code once, regenerate codes and test an Admin reset. Make TFA mandatory only after customer communication and support recovery are ready.

Setting reference

Enable TFA for Customers

Turns the storefront feature on for the current scope. Existing enrolled data remains stored when the feature is switched off, but the login challenge and account controls are inactive.

Mandatory TFA for Customers

Customers without TFA must complete enrollment after their password is accepted. The enforcement is storefront-wide: a signed-in customer without enrollment is redirected to setup from every frontend page, and an enrolled customer with a pending verification is held on the verification page. Only the TFA setup/verification routes and logout remain reachable until the flow completes. An enrolled customer cannot disable TFA while this setting is active.

Disable TFA During Admin Login as Customer

When enabled, a session created through Magento's Login as Customer workflow bypasses customer TFA. This is convenient for support, but the administrator can then enter the customer's account without the customer's authenticator.

Leave the bypass disabled when impersonated sessions must follow the customer's TFA policy. Test your support workflow either way.

Issuer Name

This is the name shown in the customer's authenticator app. Installation initially uses the configured store-information name when one is available; otherwise the fallback is Customer Account. Use a short name customers recognize.

Changing the issuer changes how newly scanned entries are labelled. It does not rotate secrets already stored for customers.

Recovery Codes Count

Controls how many ten-character, one-time codes are created during enrollment or regeneration. The default is 10. Generating a new set invalidates the previous set.

Setup Secret Lifetime

Controls how long the generated setup QR code and secret remain valid, in seconds. The default is 600. After expiry, the customer must reload setup, scan the new QR code and verify again.

Maximum Verification Attempts

Controls how many invalid codes a pending login can submit. The default is 5. Once the limit is reached, Magento cancels the pending TFA login and sends the customer back to the normal sign-in page.

This is a per-login challenge limit, not a permanent customer-account lock.

Allow Customers to Regenerate Recovery Codes

When enabled, enrolled customers can replace their recovery-code set from the account dashboard. The module shows only the number of unused codes after enrollment. It never displays the stored codes again. A regenerated set replaces the old set immediately, so codes saved from an earlier set stop working.

Disable this option when recovery-code changes must go through your support team. The regeneration form then disappears from the customer account. Customers can still use an unused recovery code during sign-in.

Recovery Code Regeneration Authentication

Choose what an already signed-in customer must provide before replacing the recovery-code set:

• Current TFA Code verifies the authenticator the account is using.
• Current Password verifies the Magento customer password.

This setting appears only while customer regeneration is allowed. Disabling optional TFA always requires the current customer password, regardless of the regeneration setting.

Allow Customers to Disable TFA

When TFA is optional, this setting controls whether an enrolled customer may remove it without contacting an administrator. The customer must confirm the current account password. A successful removal deletes the authenticator secret and all remaining recovery codes.

The disable form is hidden when this option is off. It is also unavailable while Mandatory TFA for Customers is enabled, because a customer could not continue using the account without enrolling again.

Admin permissions

Grant Reset Customer Two-Factor Authentication only to support roles that handle account recovery. Configuration access uses the separate Customer TFA configuration ACL.

The extension logs enable, disable and Admin reset events with Magento's standard logger. It does not log authenticator secrets or recovery-code values.