Your entire business - sales, purchases, GST and bank entries - lives inside Tally. If that Tally opens over the internet with only a password, one leaked password is the whole story. This guide adds the second lock: a verification code only the right person can produce.
Be clear about one thing first: local TallyPrime has no built-in authenticator-code step of its own. Its own tools are user passwords, security levels and TallyVault. So the second factor is added where your team actually walks in - the remote access portal. In this video that portal is TSplus, the software many offices use to open Tally from home or another branch. TSplus has a dedicated two factor authentication add-on: after the password, the portal asks for a 6-digit code from an app on the user's own phone. A stolen password alone then opens nothing.
Username : rajesh
Password : ••••••••••
Verification code : 4 8 2 9 1 6
The code comes from the authenticator app on the user's phone and changes every 30 seconds.
A password is something you know. A two factor code is something you have - the phone that generates it. The codes are time-based one-time passwords: a fresh 6-digit code roughly every 30 seconds, and each code works once. So even if someone copies the Tally portal password from a notebook, a chat or a phishing page, they still cannot sign in - they do not hold the phone. That single fact is the entire value of this setup.
Keep these ready before touching any setting:
On the server, open the TSplus AdminTool and enable the two factor authentication add-on. TSplus then provides a separate two factor authentication administration application (the program file is TwoFactor.Admin.exe) where every 2FA user is managed. From this point on, sign-ins to the Web Application Portal can demand a code - but only for users you add in the next step. Nobody is locked out yet, so do this calmly in office hours, not at midnight.
In the 2FA administration application:
Add people one team at a time, starting with a single test user (ideally yourself). A group is handy for switching 2FA on, but enrolment and resets always happen per person, as the later steps show.
Select a user and click Edit to choose the delivery method. The default is the authenticator app. You can instead select SMS (and enter the mobile number) or EMAIL (and enter the e-mail address). Our honest advice: keep the app as the standard. App codes are generated on the phone itself, work offline, and do not depend on a SIM card that can be swapped or a mailbox that may itself be weakly protected.
The user does the enrolment personally, once:
From the next login onwards it is always two pieces of information: credentials + the fresh code. If this enrolment is done on the wrong phone, you have protected the wrong person - which is why the admin never scans a staff member's QR code for them.
Before announcing the change, test the whole path with your test user: portal login with password only must fail without the code, and succeed with it. One behaviour surprises people: for 2FA-enabled users, TSplus denies direct RDP connections - only portal connections remain. Do not try to "fix" that; it is the protection working as designed, closing the side door that would bypass the code. Once the test passes, add the remaining users in small batches.
Portal 2FA guards the road in; Tally's own user security guards the data inside. Both are needed. In TallyPrime, press Alt+K (Company) and set Control User Access to Company Data to Yes, create an Administrator (Owner), then give every person their own user name and password under Users and Passwords with the right security level. A portal code in front of a Tally that opens with no login at all is a strong gate in front of an open house.
The video shows the complete TSplus 2FA setup live - enabling the add-on, adding users and the first QR enrolment, exactly as you will do it on your server.
▶️ Watch Full VideoLocal TallyPrime does not ask for an authenticator code when a company opens. Its built-in tools are user passwords, security levels, a password policy and TallyVault encryption. The code step is added at the access layer - for example the TSplus 2FA add-on on a TSplus-hosted Tally, or Tally's own cloud access (TallyPrime powered by AWS), which uses a Secure PIN as the second factor next to the Tally.NET login.
The authenticator app is the recommended default: codes are generated on the phone, work without any network, and are not tied to a SIM card. SMS needs a Twilio account and depends on mobile signal; e-mail depends on the mailbox staying safe. TSplus lets you set the method per user, so keep the app standard and use SMS or e-mail only for someone who genuinely has no smartphone.
The administrator opens the two factor administration application, selects the user under Manage Users and clicks Reset. At the next portal login that user is shown a fresh QR code and enrols the new phone. Verify the person properly before resetting - the reset hands the next login a brand-new enrolment.