TeamsMFA

TeamsMFA › Guides › For MSPs

Shared 2FA for MSPs

Every client has a few vendor portals, registrars and cloud consoles that only allow one admin login. Give each tech their own access to those codes, share them with the client's IT contact, and log every use.

Updated November 12, 2026

Short answer: make one TeamsMFA team per client for the accounts that only allow one admin login: vendor and distributor portals, registrars, ISP and carrier portals, single-admin SaaS tools, and the AWS root user. Your techs reveal codes as themselves, the client's IT contact can be on the same team, and every reveal is logged. Removing a tech ends their access immediately, with nothing to re-enroll.

1. The problem

  • "One person signs up for a vendor tool, the account/2FA/verification codes go to their personal work email, then they go on vacation or leave and nobody can get in."1
  • An MSP with a client whose "IT liaison and part time IT admin … want to be able to access the MFA codes for several vendor/cloud accounts."2
  • The top replies in r/msp are usually some version of "set them up with their own accounts." That's right where the vendor allows it.2,3 The trouble is the vendors that don't.

2. What it's for, and what it isn't

A good fit

  • Vendor, distributor and licensing portals that issue one login per customer.
  • Domain registrars, DNS providers, and ISP or carrier portals in the client's name.
  • SaaS tools where the first admin account can't be tied to SSO.
  • The AWS root user for client accounts, alongside named IAM users for day-to-day work.
  • Accounts the client's internal IT staff need to reach too.

Not a fit

  • Microsoft Entra and Microsoft 365 emergency (break-glass) accounts. Microsoft now requires MFA for them, and recommends passkeys (FIDO2) or certificate-based authentication for those accounts.4 Follow that guidance rather than putting a shared authenticator code on them.
  • Shared sign-ins for end users, such as a location's shared Windows account. Those are better solved with Conditional Access, device-based sign-in or individual accounts, which is where the r/msp discussion lands too.3
  • Anything that supports individual users or SSO. Use that.
  • SMS and email codes. TeamsMFA handles authenticator-app (TOTP) codes today.

3. One team per client

  1. Create a team for each client, for example "Acme: vendor accounts", with two of your senior techs as owners.
  2. Move each 2FA code in by re-enrolling it. Add a new authenticator app on the vendor's site and scan its QR code into the team, then remove the old device. See the step-by-step guide.
  3. Invite techs as viewers. They can reveal codes but can't add codes or manage people.
  4. Invite the client's IT contact as a viewer or co-owner, so they can help themselves without calling your helpdesk for a code.
  5. Keep recovery codes in your documentation system, outside TeamsMFA, in case of an outage.

Every reveal is logged with the person, time and IP address, so you can always tell who used the registrar code last Tuesday.

4. When a tech leaves

  • Remove them from each client team. Their access ends immediately, and any request after that is refused.
  • They never had the secrets, so there's nothing to re-enroll at your clients.
  • The audit log shows every code they revealed, for your offboarding record.

Compare that with an authenticator app on a tech's phone, or a 2FA secret in a password manager they could copy. Then you'd have to re-enroll every account they could reach. See TeamsMFA vs password managers.

5. A dedicated tenant for your MSP

The free plan covers 2 teams you create, with up to 10 people each, which is enough to try it with one client. For an MSP running many clients, a dedicated tenant gives you:

  • your own subdomain, with a separate database and encryption key;
  • unlimited teams and people;
  • an email-domain allowlist, so only your staff and invited client domains can sign in;
  • required passkeys for everyone who signs in.

Ask about a dedicated tenant.

Take the 2FA codes off your techs' phones

Start with one client's vendor accounts. It's free for up to 10 people per team, with no credit card.

Get started free

Sources

  1. r/ITManagers: How does your team handle shared vendor accounts and verification codes? (May 2026)
  2. r/msp: Share Google Authenticator account with client's IT folks (June 2023)
  3. r/msp: MFA for shared accounts (August 2026)
  4. Microsoft Learn: Plan for mandatory Microsoft Entra multifactor authentication ("What if I have a 'break glass' scenario?")

Microsoft, Entra and Microsoft 365 are trademarks of Microsoft Corporation. TeamsMFA isn't affiliated with or endorsed by Microsoft.