Two-factor sign-in and single sign-on
Why accounting firms should require two-factor sign-in, how authenticator apps and Google or Microsoft single sign-on are set up, and clients' own rules.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
An accounting firm holds what a fraudster wants in one place: clients' tax numbers, bank details, payroll files, identity numbers and the authority to change all of them. A single stolen password can open the lot, and the usual way passwords are stolen has nothing to do with clever hacking. Someone reuses the same password on a site that is breached, or types it into a convincing fake sign-in page.
Two-factor sign-in closes most of that gap. Single sign-on goes further for firms that already run their e-mail through Google or Microsoft. This article explains both, how each is set up in Achekam, and how your clients' own security rules affect your staff.
Why a firm is worth attacking
Criminals target firms for the same reason they target banks: the payoff is concentrated. Common patterns include a mailbox taken over and used to send a client "updated" bank details, a payroll file altered before the bank file is produced, or a former employee whose access was never removed.
A password alone defends against none of these once it is known. A second factor means the password is not enough on its own; the attacker also needs something the real user physically holds.
South African firms also carry duties when something does go wrong. The Information Regulator publishes a step-by-step guide to reporting a security compromise, which shows how a data breach is notified under section 22 of POPIA through its eServices portal. Nigeria and Kenya have their own data protection laws and regulators, and a firm in either country should know its reporting route before it needs it.
Authenticator apps
In Achekam, each user can turn on two-factor sign-in with an authenticator app. The app, on the user's phone, shows a short code that changes every few moments. After the password, Achekam asks for the current code. Someone who has stolen the password but not the phone is stopped.
A few things make roll-out smoother:
- Pick one or two authenticator apps the firm will support, so the help you give is consistent.
- Enrol people at their desks, with someone available to help, rather than by e-mail on a deadline day.
- Agree in advance how a member who loses or replaces a phone gets back in, and who in the firm handles that request. Write the process down.
- Remind staff never to read out, type in or forward a code for anyone else, whoever asks and however urgent the request sounds.
The second factor protects the account, not the inbox. Pair it with a simple firm rule that any change to a client's or supplier's bank details is confirmed by phone, on a number already on file, before anyone acts on it. Most payment fraud in firms arrives as a polite e-mail rather than a break-in.
Requiring it for every member
Optional security tends to stay optional. A firm can require two-factor sign-in for all members under SETTINGS > Security & SSO, and for an accounting practice there is little reason not to.
If you need to phase it in, start with the people who can do the most damage: partners, administrators, anyone in a payroll role, and anyone who can change permissions. In Achekam, administrators invite colleagues, give them roles and can suspend or remove them, and a firm can allow or deny what each role may do, so the accounts with administrator rights are the ones an attacker would most like to hold. Then require it for everyone.
Google or Microsoft Entra ID
Members can sign in with Google or Microsoft Entra ID once the firm sets up single sign-on, again under SETTINGS > Security & SSO.
Single sign-on suits a firm that already manages its staff accounts in Google Workspace or Microsoft 365. The firm's identity provider then carries the sign-in, with whatever second-factor rules the firm has set there, and staff have one fewer password to manage.
Two cautions:
- Single sign-on is only as strong as the account behind it. If the firm's Microsoft or Google accounts do not themselves require a second factor, turning on single sign-on moves the weakness rather than removing it.
- Removing a leaver is still a step in Achekam. When someone leaves, disable their firm account with your identity provider and also suspend or remove them under TEAM > People. Do both on their last day.
| Situation | Sensible choice |
|---|---|
| Small firm, no central e-mail accounts | Require authenticator-app sign-in for every member |
| Firm on Microsoft 365 with its own second-factor policy | Set up Entra ID single sign-on |
| Firm on Google Workspace with second-factor enforced | Set up Google single sign-on |
| Any firm | Suspend or remove leavers in Achekam on their last day |
Clients' own rules
Your firm's settings are not the only ones that apply. When a firm member opens a business's books on Achekam, they must meet that business's own IP allowlist and two-factor rules.
In practice that means a client who restricts access to certain internet addresses may block a staff member working from home or a client site, even though the firm's own sign-in succeeded. Before a deadline week, ask the clients who use Achekam whether they have such rules, and make sure the staff assigned to them can meet them. How a firm comes to hold a client's books in the first place is covered in accepting a client's appointment, and limiting which staff see a client is covered in restricting a client to named people.
A one-week plan
On Monday, decide between authenticator apps and single sign-on. By Wednesday, enrol every partner, administrator and payroll user. On Friday, switch on the requirement for all members, and add "remove access in Achekam" to your leaver checklist.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
