Securing Your Account: Essential Steps for MFA Backup Codes and Secondary Access
We highly recommend enabling Multi-Factor Authentication (MFA)—also known as Two-Factor Authentication (2FA)—to keep your account secure. While MFA provides excellent protection against unauthorised access, it can also lock you out of your own account if you lose your mobile phone or authenticator device.
To ensure you never lose access to your work, you must complete two vital steps upon enabling MFA: saving your backup codes and setting up a secondary authentication method.
1. Download and Secure Your Backup Codes
When you configure MFA, the system will provide a list of single-use backup codes. These codes are your ultimate safety net; if your phone goes missing or breaks, entering one of these codes will allow you to bypass the standard authentication prompt and get back into your account.
Download immediately: You must generate and download these codes the moment you enable MFA.
Store securely: Print them out and keep them in a locked drawer, or save them in a secure, third-party password manager.
The Golden Rule: Do NOT store your backup codes in Zoho WorkDrive. If you are locked out of your account, you will also be locked out of WorkDrive, making it impossible to retrieve the codes when you need them most.
2. Set Up a Secondary Authentication Method
In addition to downloading backup codes, you must configure a secondary option for receiving your Time-based One-Time Passcode (TOTP). This gives you an alternative, digital way to verify your identity if your primary authenticator app is unavailable.
You can set up either of the following as your secondary method:
Mobile Phone Number: Have your TOTP sent via an SMS text message.
External Email Address: Have your TOTP sent to a secondary email inbox.
Crucial Email Restriction: If you choose the email route, do NOT use an email address hosted on Zoho Mail. If your account is locked, your Zoho Mail inbox will also be inaccessible. You must use an external, independent email provider (such as a personal Gmail, Outlook, or Yahoo account) to ensure you can actually receive the passcode.
Quick Reference: MFA Dos and Don'ts
| Feature | Do | Don't |
| Storing Backup Codes | Keep them in a physical safe or an external password manager. | Save them anywhere inside Zoho WorkDrive. |
| Secondary TOTP Email | Use an external, independent email address (e.g., Gmail). | Use an email address hosted on Zoho Mail. |
Taking a few minutes to configure these safeguards today will save you a massive headache if you ever lose your primary authentication device.
- Navigate to https://accounts.zoho.com/home#multiTFA/recovery
- Enter your mobile phone number - especially if your mail is hosted on Zoho Mail
- Navigate to https://accounts.zoho.com/home#multiTFA/recovery
- Download your backup codes - and keep them safe (and not in any Zoho application, such as Vault, Notebook, or WorkDrive)
Related Articles
Steps to take in CRM when an employee leaves the organisation
When an employee leaves the business, you wish to retain all the details of the email trail between your contacts and this employee. Therefore - before deactivating the employee in your system, change the email integration setup from IMAP to POP. You ...How to generate an App Password (for example - access Mail via IMAP in CRM or another Mail client)
When you have Multi-Factor Authentication (aka Two Factor Authentication) enabled, you cannot use your regular password to configure Zoho Mail to be accessible in other applications - you need to generate an App Password. To do this, navigate to ...How to Change your Primary Zoho Login Email Address
Updating your primary login email in Zoho is a straightforward process, but it is important to do it correctly to ensure you don't lose access to your Zoho account. This guide is for users who need to update their own login credentials—for example, ...Zoho Vault account remains on Account Creation Pending - even after master password has been set
When the Zoho Vault account is stuck on Pending Account Creation for a user, the sharing handshake is not initiated. This can be resolved by manually initiate the sharing request. Note that this can only be done in the old UI (see below). Open a new ...Changing the "owner" of the Zoho One account
In Zoho One, there an "owner" of the account - this is by default the person that set up the Zoho Instance (started the subscription). If you need to change the owner, as for example, the person originally signing up has moved on, then follow these ...