Two-factor authentication in a Meta business portfolio: the requirement and the fixes

A person with full control of a business portfolio can require two-factor authentication for Admins only or for Everyone. Each person it covers then turns it on in their own account, under Accounts Center > Password and security > Two-factor authentication, and cannot open the portfolio until they do. Meta also requires it by itself for some portfolios older than 90 days, and then it cannot be turned off.

Meta's own pages word the details differently in places. Where they disagree, this guide says so rather than picking one.

What the requirement does, and whom it covers

Meta's article describes two-factor authentication as a verification code needed on top of a password when someone logs in from a device Meta does not recognize. When a portfolio requires it, everyone the requirement covers must set it up on their own Facebook account before they can access the portfolio.

Only people with full control can turn the requirement on or off. Meta's steps:

1. Go to Settings in Meta Business Suite.
2. Select Business portfolio info.
3. Scroll down to Business options.
4. Open the dropdown next to Two-factor authentication.
5. Choose Admins only (people with full control), Everyone (anyone with any access) or No one.
6. Confirm.

Meta says the change takes effect at once, and people without two-factor authentication are asked to set it up the next time they try to open the portfolio. Three other Meta articles, on Settings, on Security Center and on the people export, name Security center as the place for this setting instead, so if Business options does not show it, look there.

The 90-day rule, in Meta's two versions. The requirement article says two-factor authentication is optional for portfolios less than 90 days old, and that Meta requires it automatically for "certain business portfolios more than 90 days old". The Security Center article says it is "a requirement for business portfolios that are 90 days or older". Either way, an older portfolio may not offer No one.

Turn on two-factor authentication on your own account

Each person does this in their own account. Facebook's steps:

1. Click your profile picture in the top right, then Settings and privacy.
2. Click Settings.
3. Click Accounts Center, then Password and security.
4. Click Two-factor authentication, then the account you want to update.
5. Choose a method and follow the steps on screen.

The methods are a security key, codes from an authentication app, or text message (SMS) codes. Meta's security advice for portfolios is to use an authentication app, back it up, set up more than one method, and save recovery codes. You get 10 recovery codes under Additional methods > Recovery codes > Get new codes, and each works once.

Meta is moving people to Meta Accounts, so some people see Meta Account settings where others see Accounts Center.

Meta still asks for it after you turned it on

Meta's pages name no cause for this. These checks are built from what they say about accounts, browsers and apps:

• It is on for a different account. Accounts Center asks you to pick the account in step 4. Meta also says that if you join portfolios with your Facebook account in one and your Instagram account or a managed account in another, each identity gets its own user profile. Turn it on for the account you use with this portfolio.
• Your browser forgets you. Facebook says it must remember your computer and browser to skip the code. Private browsing, or a browser that clears its history when it closes, means a code at every login. When you set it up, Facebook offers Save this browser; do not use it on a shared computer.
• An app is asking, not the portfolio. Meta says a third-party app that manages your Pages or ad accounts asks for a verification code the next time you sign in from it.
• The requirement just changed. People are prompted the next time they open the portfolio after a person with full control turns it on.

Lost your codes or your phone

Facebook's troubleshooting page suggests these, in order:

1. Wait a few minutes for a text message code, and check your phone has signal.
2. Approve the login from another device or browser where you are still logged in.
3. Use one of your saved recovery codes.

If none works, start logging in until the code screen, then:

• On a computer: click Need another way to authenticate?, then Other Options, then Get more help.
• On Android or mobile web: tap Having trouble?
• On iPhone or iPad: tap Need help?

Facebook then asks you to confirm your identity, for example with an ID, and says you typically get instructions within 1 to 2 business days. If you have no phone at all, look for I don't have my phone and then Contact Us. Facebook says identity confirmation does not work in Facebook Lite, so use the full app or a browser.

Once you are back in, add a second method so this does not happen again.

Passkeys

Meta now offers passkeys, which use your device's fingerprint, face scan or screen lock instead of a password and a code. Meta says some business portfolios may require them, for example those that advertise, use monthly invoicing or credit lines, or pass certain spend or reach thresholds. Two things to know:

• Meta says passkeys are currently not supported in the Meta Business Suite or Ads Manager mobile apps.
• Once you use a passkey regularly, Meta may remove other login methods such as SMS and email codes. A lost passkey can be replaced from Accounts Center.

For agencies: your staff and a client's requirement

Meta's partner steps tell the client to turn on two-factor authentication for its portfolio before sharing with an agency, so a client may switch it on right before the share.

In the agency's own portfolio, you decide. Turning the requirement on has a side benefit: Meta's People and permissions export only shows whether each person has two-factor authentication on when the requirement is turned on. Meta's Security Center also recommends removing people who have no passkey or two-factor authentication until they set one up; the steps are in how to remove someone from a business portfolio.

If a client cannot finish sharing because of two-factor authentication, the short version of this page is in Meta sharing errors, and the access checklist lists what to ask for once it is sorted.

Security Center

Security center is in Settings in Meta Business Suite. Meta's Security Center article lists three things you can do there: require two-factor authentication, add another person with full control of the portfolio, and check the business verification status. Its Settings article adds managing trusted email domains. Meta says security alerts that need attention appear at the top of the portfolio's home page until you deal with them.