Security
Two-Factor Authentication | Single Sign-On | Change LogTwo-Factor Authentication
Settings > Security > Two-Factor Authentication
Additional Security Layer for Login
Two-Factor Authentication (2FA) provides an extra layer of security. It ensures that only the authorized user can access their account and sensitive data, even if someone else knows their personal password. Access to sensitive areas* within MOCO requires the user to enter a code. This code is available on the user's smartphone via an app and changes every 30 seconds.
Requirement: Each user must have an authentication mobile app (e.g., Authy, Google Authenticator, or Microsoft Authenticator, other apps are also possible) installed on their smartphone. With this app, users add the MOCO account by scanning the initially displayed QR code.
Requirement: Each user must have an authentication mobile app (e.g., Authy, Google Authenticator, or Microsoft Authenticator, other apps are also possible) installed on their smartphone. With this app, users add the MOCO account by scanning the initially displayed QR code.
Activating 2FA
- First, each user must install an authentication mobile app like Authy or Google Authenticator on their smartphone.
- Enable 2FA in the settings under "Account" > "2FA" for the entire account.
- After activation, all users must add the MOCO account in the installed authentication app by scanning the displayed QR code once.
Once logged in, users will be asked for the verification code every 24 hours. If a different interval is preferred, just contact us - we are happy to adjust it individually.
English image not yet available...
Switching to a new smartphone or authenticator app or other issues:
2FA Troubleshooting

*Sensible Bereiche sind alle Bereiche ausser "Zeiterfassung", "Kontakte" und das eigene Profil. Diese sind von der 2FA ausgenommen und weiterhin wie gewohnt und ohne zusätzlichen Code verfügbar.
Switching to a new smartphone or authenticator app or other issues:
2FA Troubleshooting
Single Sign-On
Settings > Security > Single Sign-On
Login via Google, M365, or Okta
With Single Sign-On (SSO) using Google, Microsoft Office 365, or Okta (SAML protocol), all users can log in securely, conveniently, and with just one click. As an alternative to 2FA, SSO offers excellent security and control for user management in MOCO.
Setup and Activation
In the settings under "Security" > "Single Sign-On," you start the setup and complete the following steps:
English image not yet available...

1. Upload your Identity Provider's Configuration XML
You can either enter the .xml URL directly or upload the .xml file yourself.
2. Retrieve MOCO's Configuration XML
You can now access the configuration XML provided by MOCO with all metadata via URL or download it as a file. Please extract the necessary information from it or, if possible, directly provide the link/file to your Identity Provider.
You can now access the configuration XML provided by MOCO with all metadata via URL or download it as a file. Please extract the necessary information from it or, if possible, directly provide the link/file to your Identity Provider.
3. Activate Single Sign-On
Once the configuration is in place, you can activate SSO using the green button. Log out of MOCO and test the new login method.
Once the configuration is in place, you can activate SSO using the green button. Log out of MOCO and test the new login method.
Find valuable setup tips in our help article. Contact our support if you encounter any issues.
Notes
- SSO replaces Two-Factor Authentication
Disable 2FA if it is currently enabled. - Allow login with email and password (4)
This can be disabled via the MOCO in-app service. - Automatically create new users in MOCO on first SSO login (4)
Users must now be created at the Identity Provider. This can be disabled via the MOCO in-app service.
Change Log
Settings > Security > Change Log
All significant changes and comments on proposals, projects, invoices, etc., are now centrally accessible. Additionally, other critical activities within the account are systematically recorded.

The list can be filtered by areas (What?), individuals (Who?), and time periods (When?), or you can search using keywords in the free text field. If needed, entries can be exported in XLSX format.
The following changes, among others, are documented:
- All comments/notes that you can usually view with individual objects are compiled here
- Deleted objects – e.g., proposals, invoices, absences, accounting exports, companies and contacts, API keys
- Changed settings – e.g., change of account owner, access rights, bank account, period lock
- User switches
Changes from the past 30 days (MOCO Pro) or 180 days (MOCO Unlimited) are available.