Unanswered

SMS Multifactor Authentication

(0) Share

Report

Posted on by MrOzog

Hi,
I’m going to automate QuickBooks online.
QuickBooks has two-factor authentication (which can be turned off) and multifactor authentication which cannot be turned off. Usually, it’s SMS with a code.
Have you ever automated QuickBooks online and successfully bypass that authentication?
Or maybe you were working with a different application with SMS authentication and can share your ideas?

Categories:

Power Automate Desktop

I have the same question (0)

All responses (4)

Answers (0)

Sort by

MichaelAnnis 5,727 Moderator on at

Like
a
(0)

Report
Copy link

Link copied!

If you can forward it to your email, then you could pull the code from there. Here is iPhone instructions for forwarding texts to an email:

https://howtosguru.com/how-to-automatically-forward-text-messages-on-iphone/#:~:text=There%20are%20a%20few%20ways%20to%20automatically%20forward%20text%20messages,want%20to%20forward%20messages%20from.

google (android) has something similar.

once it is in the email on the computer, read the email, parse the text, etc til you just get the code as a variable and you should be able to enter it.

best of luck!

Was this reply helpful? Yes No
MrOzog 4 on at

Like
a
(0)

Report
Copy link

Link copied!

HI,
Thank you very much for your answer.
The solution from that link is not working.
I'll try to find an app which can send SMS to email.

Was this reply helpful? Yes No
perrilove 26 on at

Like
a
(0)

Report
Copy link

Link copied!

We're currently exploring the Twilio connector in Power Automate to solve for this. It might help you if you haven't found a solve yet @MrOzog. If you have, can you explain how you got around the MFA code please?

Was this reply helpful? Yes No
momlo 1,527 Super User 2024 Season 1 on at

Like
a
(0)

Report
Copy link

Link copied!

As @MichaelAnnis suggested, you can set up SMS to email forwarding, then flow (cloud or desktop) check the email for the code.
However, it poses some risks, such as other sensitive text messages forwarded to the email, dev access to the person's account without their timely knowledge, etc.

What is possible, depending if this is desired to make user aware of the flow execution/logon to the site, is this:

1. Use PA cloud flow to run PAD flow that logs to the app
2. When the app asks for a token - PAD calls PA (cloud) flow that posts a message on teams (adaptive card, for example)/other supported messenger app
3. User responds with a code, or info that they want to cancel
4. CLoud flow completes and passes the data to the PAD flow
5. PAD flow completes the login process or cancels based on the returned information.

So it all depends on what process you want to implement and risks/decisions you and the person owning the app account take

Was this reply helpful? Yes No