Buildium MFA Setup and Security Policy Configuration Guide

Turn on multi-factor authentication in Buildium by enabling it for your account (and then requiring it for all staff), switch login to an authenticator app instead of SMS when possible, tighten password rules, limit who has admin access, and review audit logs regularly. If everything is already set up, verify enforcement is on for every user, confirm recovery options, and run a quick security check (roles, devices, logs, and vendor access).

 

Enable multi-factor authentication (MFA)

 

• What MFA means: a second proof after your password (usually a 6-digit code from an app). It blocks most “stolen password” logins.
• In Buildium, open Settings and look for Security or Login & security.
• Turn on Two-factor authentication (same idea as MFA).
• Choose Authenticator app if available (more reliable than SMS for people who change phone numbers or travel).
• Scan the QR code with Google Authenticator, Microsoft Authenticator, or Authy, then enter the code to confirm.
• Save backup codes in a secure place (password manager or locked admin file). Do not store them in email.

 

Require MFA for everyone (security policy)

 

• In the same Security area, enable Require 2FA for all users (wording may vary).
• Set a deadline and notify staff: anyone not enrolled will be forced at next login.
• Do not allow shared logins. Each person needs their own user so MFA and audit logs work.

 

Harden passwords and access

 

• Set a strong password rule: long passphrases (12 to 16+ characters) are better than short complex ones.
• Review User roles: give Admin only to people who truly need it (banking, integrations, user management).
• Remove old staff, vendors, and temporary accounts immediately.

 

Validate and troubleshoot

 

• Test with a non-admin user: log out, log in, confirm MFA prompt appears.
• If codes fail, fix device time: enable automatic date/time on the phone (time drift breaks codes).
• If a user lost the phone, use backup codes or have an admin reset 2FA for that user, then re-enroll.
• Avoid VPN login issues: if logins keep failing, try a normal connection and confirm no browser extensions are blocking prompts.

 

If everything is already set up

 

• Confirm enforcement is on for all users, not just optional.
• Check every admin has authenticator app enrolled and backup codes saved.
• Review audit/activity logs weekly for unfamiliar logins, new payees, bank changes, or export spikes.
• Re-check integrations and vendor access: only approved apps, least-privilege permissions.

 

When to contact Buildium support

 

• Locked out with no admin able to reset 2FA.
• Suspected account takeover, unauthorized bank or payment setting changes.
• MFA enforcement option missing (may depend on plan or account configuration).