# NetSuite Administrator Security and 2FA Hardening Checklist > Source: https://netray.co/tools/netsuite-admin-security-2fa-hardening-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Review NetSuite authentication, roles, integration tokens, login monitoring and data access in one checklist, with the critical controls marked. ## Category netsuite ## Erp NetSuite ## Audience - NetSuite administrator - IT security - Internal audit ## Tool **Kind:** checklist **Groups:** #### Authentication **Items:** **Text:** Confirm 2FA is enforced for Administrator and other highly privileged roles, which NetSuite makes mandatory for UI access **Critical:** true Review Setup > Users/Roles > Two-Factor Authentication Roles and add finance, payroll and integration-admin roles Make sure each 2FA user has stored backup codes and a second verification method Review the trusted device duration set for each 2FA role against your policy If you use SAML SSO, confirm which roles sign in through SSO and how 2FA is handled by the identity provider Set password length, complexity and expiration in General Preferences to match your policy Ask users to keep their security questions and contact details current where the account uses them For '2FA not working' tickets, check device time sync, the role's 2FA setting and backup code use before resetting #### Roles **Items:** **Text:** No shared Administrator logins; every admin has a named user **Critical:** true Move remaining users off the deprecated Full Access role Keep the number of Administrator role holders to the minimum named list Build custom roles on least privilege and review them against a role permission matrix Review Global Permissions on employee records (Access subtab), which apply across all of that user's roles Evaluate the Core Administration Permissions feature to let non-admin roles do specific admin tasks Use roles marked Web Services Only for integration users #### Integrations **Items:** Enable only the authentication flows each integration record needs (TBA, OAuth 2.0 authorization code, client credentials) **Text:** Revoke access tokens and OAuth 2.0 authorizations for leavers and retired integrations the same day **Critical:** true Use HMAC-SHA256 for TBA signatures Restrict the SuiteAnalytics Connect role and who holds Read All Limit RESTlet deployment audiences to the integration roles that call them Track OAuth 2.0 client credentials certificate expiry and rotate before it lapses #### Monitoring **Items:** **Text:** Review the Login Audit Trail (Setup > Users/Roles > User Management > View Login Audit Trail) for failed logins and unusual IPs every week **Critical:** true Save a login audit trail search filtered to failures and Administrator logins and schedule it to security Review System Notes on roles and employees for permission and role changes Run a user access review from Setup > Users/Roles > Manage Users or an employee saved search of roles and login access Remove login access for inactive and departed users Review the Access Tokens list each quarter and remove tokens nobody owns #### Data access **Items:** Use IP address rules (a feature enabled in Enable Features) where users work from known networks Restrict sensitive fields such as bank details and salary on forms and roles Set file cabinet folder restrictions for HR, payroll and contract folders Check which roles can export lists and run CSV import Document the review date and reviewer for each group for audit evidence **Scoring Note:** The critical items cover how most account compromises and audit findings happen: shared or unprotected admin logins, tokens left live after people leave, and nobody reading the login trail. ## Content **Intro:** This checklist reviews NetSuite account security from an administrator's seat: authentication and 2FA, roles, integration credentials, login monitoring and data access. It is built for a quarterly access review or an audit request. **Sections:** #### How to use it **Body:** Work through it once as a baseline with the security or audit lead, then repeat the monitoring and integration groups every quarter. Tick items with evidence: a screenshot of the 2FA roles page, the exported user list, the login audit search. Export the result to PDF or Excel and keep it with the review date, which is what auditors ask for. Items that need a decision, such as which extra roles require 2FA or whether to use IP rules, should be written into your access policy so the next review checks against it rather than starting again. #### Where the controls live in NetSuite **Body:** 2FA roles and their settings are at Setup > Users/Roles > Two-Factor Authentication Roles. Password rules are in General Preferences. Users and their roles are managed at Setup > Users/Roles > Manage Users and on each employee's Access subtab, which also holds Global Permissions. Integration records are under Setup > Integration > Manage Integrations, and tokens under Setup > Users/Roles > Access Tokens. The Login Audit Trail is at Setup > Users/Roles > User Management > View Login Audit Trail and can be saved as a search. IP address rules are a feature you enable and then configure for the company and roles. #### Worked example **Body:** Before a SOX walkthrough, an admin exports the users with the Administrator role and finds five, two of them a shared 'admin' login used by a consultant. The shared login is replaced with a named user, and the consultant's old tokens are revoked from the Access Tokens list. The 2FA roles page shows the AP Manager role, which can edit vendor bank details, is not on the list, so it is added. A saved login audit search filtered to failed logins shows repeated failures from one IP against an integration user, traced to an expired password on a legacy connector that should have been on TBA. #### Common mistakes **Body:** Assuming the Administrator role is the only one that needs 2FA, while roles that can change bank details or approve payments do not have it. Sharing an admin login with a partner. Leaving tokens live after an integration or employee leaves. Giving integration users full UI roles instead of Web Services Only roles. Granting Global Permissions on an employee record and forgetting they apply to every role that user has. Collecting login audit data but never reviewing it. **Cta:** If you want security reviewers to ask NetSuite in plain English who holds which permissions and who logged in from where, on infrastructure you control, we can set that up. **Faq:** #### Why is NetSuite 2FA not working? **Answer:** Check that the device clock is synced for authenticator apps, that the user is on the role you think, and whether the role requires 2FA. Users can sign in with a backup code if they have one. An administrator can reset a user's 2FA settings so they enroll again. Check the Login Audit Trail for the exact failure. #### Which NetSuite roles must use 2FA? **Answer:** NetSuite requires 2FA for the Administrator role and other highly privileged roles when signing in to the user interface. You can add any other role on the Two-Factor Authentication Roles page. Good candidates are roles that change vendor bank details, approve payments, manage users or edit financial setup. #### How do I get a user access report in NetSuite? **Answer:** Use Setup > Users/Roles > Manage Users for a list of users and roles, or build an employee saved search showing name, role, login access, last login and global permissions. Export it to Excel for review. Combine it with System Notes on roles to show what changed since the last review. #### What does Global Permissions on an employee record do? **Answer:** Global Permissions, on the employee's Access subtab, grant permissions to that user in every role they hold, on top of each role's own permissions. They are useful for one-off needs but easy to forget during access reviews, so include them in every review and prefer a custom role where possible. ## Search terms netsuite 2fa not working, netsuite two factor authentication roles, netsuite update security questions, netsuite user access report, employee record permission netsuite, netsuite manage users report, netsuite login audit trail, netsuite security best practices --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json