A CA office is a special risk shape: one server, one team, and the books of dozens of clients. One leaked login does not expose one business - it exposes all of them. Here is how 2FA and user discipline fit a practice.
In a CA office the pattern repeats everywhere: articles and accountants log in to client companies, partners review from home during filing season, and staff move between clients all day. The technology from the main guide - TSplus 2FA on the portal, named users inside Tally - is the same. What changes is the discipline around whose data it is: most of the books on your server are not yours, and your security habits are part of the trust clients place in you.
Never work inside a client's books as a shared "CA" login, and never as the client's Owner if it can be avoided. Ask the client to create a named user for your team member (for example CA-Team-Rajesh) with the level the work needs. When that staff member leaves your office, the client removes one user - cleanly, without changing their own passwords or disturbing their staff. Your office keeps a simple register of which team member holds a user in which client company.
Inside your own office company and client companies alike, Owner-level rights belong to partners and at most one senior. Articles get levels that allow entry and viewing, not alteration of finalised periods or deletion. TallyPrime's custom security levels exist for exactly this - build one "Article" level once and reuse it across clients, instead of handing everyone Owner rights because it was quicker.
During return season the whole team works longer hours, from more places - homes, client premises, late evenings. That is precisely when a password-only portal is weakest: more logins, more shared machines, more hurry. With TSplus 2FA on the portal:
TallyPrime's edit log tracks changes to transactions with the user, date and time, and lets you compare a modified voucher with its previous version. In a practice this is gold - a client questioning an entry can be shown who changed what, when. But the log is only as truthful as the logins behind it: shared users make it worthless. Named users plus 2FA are what turn the edit log from a formality into evidence.
Engagements end. The professional close-out is: hand over the complete data and backups, then have your office's users removed from that company and delete any copies your office no longer needs to keep. Keeping silent access to a former client's live books "just in case" is a liability, not a favour. The same honesty applies in reverse when staff move to another firm - no one carries enrolments or client passwords with them.
Practices run on documentation, so document this too. One page, signed by the partner:
When the rule is written, a new article learns it on day one instead of absorbing whatever habits happen to be around.
Watch the video for the technical half of this routine - switching on TSplus 2 step verification for the portal your team already uses.
▶️ Watch Full VideoNo - and a good office should refuse it. Ask the client to create a separate named user for your team with the rights the work needs. Revocation is then clean, the client's own password stays private, and the edit log shows your team's work under your team's names.
By seconds per sign-in: one code from the phone at login, and enrolment happens only once. Compare that with the cost of one client's books being opened by a leaked shared password - the arithmetic is not close.
TSplus and Tally users do not expire by themselves in this setup, so the time limit is your process: write the removal date down when the user is created, and run the leaver routine on that date. A calendar entry owned by a named senior makes it actually happen.