How to share MFA for a shared admin account
SaaS platforms increasingly require multi-factor authentication for shared integration accounts, but standard methods like push notifications tie access to a single engineer's phone. This creates a single point of failure that prevents other administrators from logging in to fix broken integrations. Teams are forced to either risk using a single device or put the second factor in a password vault, which locks them out of everything if the vault goes down.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Use TOTP-based MFA and share the initial QR code or setup key among admins so they can scan it into their own authenticator apps.Did this help you?
- 2Store the TOTP secret key or passkey in a shared password manager vault (e.g., 1Password).Did this help you?
- 3Use API-only integration users where vendors allow it to avoid UI logins entirely.Did this help you?
- 4Assign a named owner per connection and set calendar reminders to proactively re-authorize before tokens expire.Did this help you?
- 5Storing the TOTP seed in a shared vault using a password manager like 1Password or Bitwarden.Did this help you?
- 6Scanning the TOTP QR code into each individual admin's personal authenticator app.Did this help you?
- 7Keeping a cheap, shared Android tablet or physical MFA token in a secure office room.Did this help you?
- 8Routing SMS authentication codes to a Google Voice number that forwards to a shared Slack or Teams channel.Did this help you?
- 9Printing recovery codes and keeping them in a physical safe to prevent being locked out if the password manager goes down.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“Once wrinkle we've run into is that a lot of these SaaS platforms now require that even this account be subject to MFA.”source ↗
“We don't want to associate this shared account to any 1 engineer's phone's authenticator app.”source ↗
“How do we go about satisfying the MFA requirement, but have it such that multiple engineers can generate the TOTP from some kind of shared location?”source ↗
“This is a "security theoretical" ideal but deal with average SaaS provider and you'll find there's one superadmin and you don't get a say in it.”source ↗
“the chicken and egg problem with putting the second factor inside the same vault is the annoying part, since if that vault is down you're locked out of everything at once.”source ↗
“If the only option is push notification we have not found a good solution.”source ↗
“Because most of the integrations (d&b, sales navigator, databook) require an interactive web login, MFA gets triggered. Multiple admins need access to this account in case something breaks.”source ↗
“The worst setup is the current one, where one person’s phone is the single point of failure for three integrations”source ↗
Where this came up
People with this problem also raised
- 4Why do I have to pay per-user licenses for shared computers?
- 2Why do privileged Salesforce users have to create separate passkeys?
- 2Why does accounting software force logins for every company file?
- 2Can multiple Windows users open a KeePass database?
- 3How to manage multiple accounts on one platform without logging out?
- 3How to manage multiple business email accounts without a chaotic mess