Short answer: Odoo supports two-factor authentication with an authenticator app, but each user chooses whether to turn it on. Even an administrator with full access can skip it forever. To make authenticator-app 2FA mandatory for chosen groups, install Force 2FA for Admins by Vayasoft. You pick a group and a grace period, and anyone without 2FA by the deadline is blocked from the backend until they set it up.
Why isn’t Odoo’s own 2FA enough?
Odoo’s authenticator-app 2FA (the auth_totp module) works well once a user enables it. The problem is that enabling it is optional:
- There’s no deadline and no enforcement for authenticator-app 2FA.
- There’s no recovery code. If a user loses their phone, an administrator has to fix it in the database.
- There’s no view of who is protected and who isn’t.
Odoo can enforce an emailed login code for users. For accounts with the most access, many teams want a real authenticator app instead, which is what this app enforces.
Odoo core vs. Force 2FA for Admins
| Capability | Odoo core | Force 2FA for Admins |
|---|---|---|
| Authenticator-app 2FA (TOTP) | Yes | Yes, built on Odoo’s own |
| Mandatory 2FA for chosen groups | No | Yes |
| Grace period before lockout | No | Yes, per group |
| Recovery codes for a lost phone | No | Yes, single-use |
| Compliance dashboard | No | Yes |
| Emergency bypass with audit trail | No | Yes, time-boxed |
| Reminder emails | No | 7, 3 and 1 day before the deadline |
How do I force 2FA in Odoo?
- Install Force 2FA for Admins.
- Go to Settings > Security > Force 2FA > Rules.
- Create a rule: pick a group and a grace period. For example, Administration with 0 days and Accounting with 7 days.
- Each user’s countdown starts when they’re first detected in the group, so nobody gets a shortened deadline by accident.
- Users get reminder emails 7, 3 and 1 day before their deadline.
- When the deadline passes, the user is sent to a setup page with a QR code and a 6-digit check. Nothing else opens until it’s done.
- After setup, the app shows one-time recovery codes exactly once.
What happens if someone loses their phone?
They use a recovery code on the login screen. Each code works once. Codes are salted and hashed like passwords, so they can’t be read back later, only regenerated.
If you locked someone out by mistake, an administrator can grant that one person a time-boxed bypass with a reason. It expires on its own and is logged with everything else.
Frequently asked questions
Does this replace Odoo’s own 2FA?
No. It builds on Odoo’s auth_totp module and the same authenticator apps, such as Google Authenticator or Authy. It adds the enforcement, grace periods, recovery codes and visibility that Odoo doesn’t include.
Can I set different rules for different groups?
Yes, as many as you like, each with its own grace period. If a user falls under two rules, the earliest deadline applies.
Does Odoo’s own email 2FA setting still work?
Yes. If Odoo’s email-based 2FA policy is already on for a user, it takes precedence for that user.
Is there an audit log?
Yes. Every setup, bypass, lockout and recovery-code use is written to a permanent, exportable log.
Make your Odoo login harder to break
Mandatory 2FA works best alongside a strong Odoo password policy and tight access rights.
Talk to Vayasoft
Want a second pair of eyes on your Odoo security? Vayasoft runs a free 30-minute Odoo security review covering 2FA, passwords, admin accounts and access rights, and sends you a short written report.
Links: Force 2FA for Admins on the Odoo App Store · Force 2FA for Admins product page
About Vayasoft: Vayasoft is an official Odoo Ready Partner based in India. We build Odoo apps and implement, upgrade and support Odoo for trading, manufacturing, solar EPC, retail and healthcare businesses.