An extra layer of protection for your account
Two-step verification (2FA) is a key tool for ensuring account security and preventing unauthorized access. Implementing it adds an additional layer of protection by requiring a second authentication factor, minimizing the risks associated with compromised passwords.
Starting November 9, 2026, High security level will be the only available setting. All Property Manager staff must have 2FA configured to access VRMS.
Key definitions
Trusted IP address: a record identifying authorized access from a specific location.
Authentication app: a mobile application that generates unique security codes to validate access.
What is two-step verification?
2FA strengthens account security by requiring a second authentication factor when logging in.
This means that even if someone obtains your password, they won't be able to access your account without the verification code generated by your authentication app.
When 2FA is configured, your IP address is registered as trusted after successful verification. You may be asked to verify your identity again when accessing VRMS from a new IP address.
High security level the only available setting
Starting November 9, 2026, 2FA will be mandatory for all users at all companies.
Companies already at High security level: no changes for users who have already configured 2FA.
Companies currently at Low security level: their security level will automatically change to High.
Users without 2FA configured: will have five days to complete the setup.
New users: will have five days from their account creation date to configure 2FA.
Users with an existing setup deadline or extension: will keep their current deadline.
Deactivated users: will not receive a setup deadline.
Owners and Suppliers are not affected by this change. Their current authentication process remains unchanged.
How to activate it
The two-step verification setup is available in the VRMS > Configuration > Company
Starting November 9, 2026, the security level will be set to High and can no longer be changed.
Important
In high level mode, users who have not configured 2FA will have five days to do so.
What happens if your setup deadline expires?
If you haven't configured 2FA within the required five-day period, you will no longer be able to access VRMS until the setup is completed.
You can request an extension, which must be approved by a company Administrator.
If you are the only Administrator in your company, your extension request will be handled by Avantio Support. Your identity will be verified before the extension is approved.
Security notifications
Whenever 2FA is activated on an account, the account holder receives an email with the subject: “2FA has been activated on your account”
This notification allows you to identify unexpected activity and take action if you did not activate 2FA yourself. The email does not contain any action links.
⚠️Important security reminder
Avantio will never ask you to share your 2FA verification code by email, phone, or chat.
Never share your verification codes with anyone. They are personal and must only be entered directly into VRMS when requested.
Step-by-step configuration 2FA
Each user edits their own settings in their profile.
To do this, go to VRMS > Settings > Users > Profile > Edit > Security.
Log in with your username and password.
If this is your first login, a pop-up window will appear for configuration.
If you already have an active account but haven’t configured 2FA yet, you’ll see an icon next to the message “Protect your account” in the bottom-right corner of the screen.
Download an authentication app on your mobile device. The most common ones are Google Authenticator, Microsoft Authenticator, Twilio, or Duo.
Open the app and follow the instructions to add your Avantio account.
Scan the QR code displayed on the screen or enter the accompanying manual code.
If the code expires or is incorrect, the system will notify you and allow you to try again.
Once validated, you’ll receive a confirmation message, and your account will be protected.
Useful tip
Verification codes expire quickly. If one expires, generate a new code from your authentication app and re-enter it in the system.
Frequently asked questions
Why is it important to activate 2FA?
Why is it important to activate 2FA?
Two-step verification adds an extra layer of security to your account. Even if your password is compromised, no one can access your account without the second authentication factor.
Is two-step verification mandatory?
Is two-step verification mandatory?
Yes. Starting November 9, 2026, High security level will be mandatory for all companies in VRMS. All Property Manager staff must have 2FA configured to access their accounts.
Can a company switch back to Low security level?
Can a company switch back to Low security level?
No. Starting November 9, 2026, High will be the only available security level and cannot be changed.
What happens if I don't configure 2FA?
What happens if I don't configure 2FA?
You will have five days to configure 2FA. After this period, you will no longer be able to access VRMS until setup is complete.
When does my five-day setup period start?
When does my five-day setup period start?
For existing users without 2FA, the period starts on November 9, 2026.
For new users, it starts on the date their account is created.
Users who already have a setup deadline or an approved extension will keep their current deadline.
What happens if my setup deadline expires?
What happens if my setup deadline expires?
You will need to request an extension, which must be approved by a company Administrator.
If you are the only Administrator in your company, Avantio Support will handle your request and verify your identity before approving the extension.
Does this change affect Owners or Suppliers?
Does this change affect Owners or Suppliers?
No. Owners and Suppliers are not affected by this change. It applies to Property Manager staff in this phase.
Does two-step verification affect PMS API integrations?
Does two-step verification affect PMS API integrations?
No. API tokens do not use interactive login, so this change does not affect PMS API integrations.
Which authentication app can I use?
Which authentication app can I use?
You can use Google Authenticator, Microsoft Authenticator, Twilio, or Duo. All serve the same purpose of generating verification codes.
Will Avantio ever ask me for my 2FA verification code?
Will Avantio ever ask me for my 2FA verification code?
No. Avantio will never ask you to share your verification code by email, phone, or chat. Never share your codes with anyone.