Tally ERP 2FA Setup

Why a Password Alone Is Not Enough

Everything of the business — sales, purchases, GST and bank entries — lives inside Tally. When that Tally opens over the internet through TSplus with only a password, one leaked password — copied from a notebook, a chat or a phishing page — is the whole story. Two factor authentication adds the second lock: after the password, the portal asks for a 6-digit code from an app on the user's own phone. A stolen password alone then opens nothing.

The code is a time-based one-time password: a fresh 6-digit code roughly every 30 seconds, and each code works once. Be clear about where the second factor lives: local TallyPrime has no built-in authenticator-code step of its own — its own tools are user passwords, security levels and TallyVault. So the second factor is added where your team actually walks in — the remote access portal — and in this video that portal is TSplus.

Keep These Ready Before You Start

Keep these ready before touching any setting. You need TSplus Remote Access in the Mobile Web or Enterprise Edition — TSplus states this edition is mandatory for the 2FA add-on. You need the TSplus two factor authentication add-on itself — it is a separate paid add-on for TSplus, not a free default feature. And every user needs an authenticator app on their own phone — Google Authenticator, Microsoft Authenticator or Authy all work.

Switch the Add-on On in the AdminTool

On the server, open the TSplus AdminTool and enable the two factor authentication add-on. TSplus then provides a separate two factor authentication administration application — the program file is TwoFactor.Admin.exe — where every 2FA user is managed.

TwoFactor.Admin.exe

From this point on, sign-ins to the Web Application Portal can demand a code — but only for users you add in the next step. Nobody is locked out yet, so do this calmly in office hours, not at midnight.

Add the Users and Groups

In the 2FA administration application, open the Manage Users tab, click Add and pick the Windows users — or whole groups — who must sign in with a code, then click OK. They are now enabled for two factor authentication.

Choose How Each User Receives the Code

Select a user and click Edit to choose the delivery method. The default is the authenticator app. You can instead select SMS (and enter the mobile number) or EMAIL (and enter the e-mail address).

First Login — the QR Code Enrolment

The user does the enrolment personally, once. They sign in to the TSplus Web Portal with the normal username and password, and an activation message appears with a QR code on the screen. They open the authenticator app on their phone and scan the QR code — a TSplus entry appears in the app — then enter the code the app shows to finish the activation. From the next login onwards it is always two pieces of information: credentials plus the fresh code.

Test the Login, Then Roll Out to Every User

Before announcing the change, test the whole path with your test user: a portal login with the password only must fail without the code, and succeed with it. Once the test passes, add the remaining users in small batches — every user, not just the administrator. The accountant, the data entry operator, everyone who signs in to Tally gets the second factor; a single account left on password-only is the open door this whole setup was meant to close.

Add TallyPrime's Own User Security

Portal 2FA guards the road in; Tally's own user security guards the data inside. Both are needed — do not skip this side of the lock. In TallyPrime, press Alt + K (Company) and set Control User Access to Company Data to Yes, create an Administrator (Owner), then give every person their own user name and password under Users and Passwords, with the right security level.

Lost Phone? The Admin Reset Route

A lost or changed phone is a normal day, not an emergency — and the recovery is an administrator action: the user cannot reset their own enrolment. In the 2FA administration application, open the Manage Users tab, select the user and click Reset, then confirm. At the user's next portal login a new QR code is shown; they scan it into the authenticator app on the new phone and they are back in. The old enrolment stops working from the reset. The neighbouring actions cover the other cases: Edit changes the delivery method, phone number or e-mail, and Remove takes a user out of 2FA completely.