QuickBooks Online is where many small and mid-sized businesses keep supplier bank details, pay bills and run payroll, so a stolen admin sign-in, an over-privileged user or an unchecked supplier edit can send a payment to a criminal's account. Intuit provides the building blocks to prevent that: multi-factor authentication on every Intuit Account, a set of user roles from Primary admin down to Track time only, an audit log that cannot be switched off, per-transaction audit history and an integrations page for reviewing connected apps. This guide shows how identity and access work in QuickBooks Online, how to assign admin and standard roles, how to govern connected apps and OAuth tokens, how to use the audit log to catch payment fraud, and a hardening baseline. It is for business owners, finance managers, accountants and the IT or security staff who support them. Every control described is a customer-side setting under the shared responsibility model.
This is an independent guide from NHI Mgmt Group, based on Intuit's public QuickBooks documentation as of November 2026. It is not sponsored or reviewed by Intuit. Product features change, so confirm settings against Intuit's current documentation.
Key takeaways
- Admins are the crown jewels. The Primary admin and company admins have full access, including managing users and roles, so keep the number small and protect each with two-step verification on top of the built-in MFA.
- Use the narrowest role that fits. Roles such as Accounts payable manager, Accounts receivable manager and View company reports let you give people the work they need without full access.
- The audit log is always on. Intuit states it records sign-ins, settings changes, edits to customers, suppliers and employees, deleted transactions and app activity, keeps events for two years and cannot be disabled; review it on a schedule.
- Connected apps hold OAuth tokens. Only admins can connect and manage apps, and each connection keeps a refresh token, so review Manage integrations regularly and disconnect what has no owner.
- Verify supplier bank changes before paying. Every change to a supplier record shows in the audit log; confirm it by phone to a known number before the next bill payment. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.
How identity and access work in QuickBooks Online
Each person signs in with an Intuit Account, a single identity that can be used across Intuit products and invited into one or more QuickBooks companies. The Intuit Account carries the password and verification methods; the QuickBooks company decides the role that account holds. External accountants use their own Intuit Accounts, often through an accountant product, and are invited into client companies as accountant users.
Multi-factor authentication and two-step verification
Intuit separates two controls, as its help article on account verification explains:
| Control | When it prompts | Can it be turned off? | Recommendation |
|---|---|---|---|
| Multi-factor authentication | Sign-in on a new or unrecognised device | No, Intuit states it cannot be disabled | Baseline for everyone |
| Two-step verification | Every sign-in | Yes, optional; turning it off needs the account password | Turn on for every admin and anyone who can pay bills or edit suppliers |
| Authenticator app | Supplies the one-time code | Set up under Sign in & security, Authenticator | Prefer it over codes sent to a phone number |
Settings live in the Intuit Account under Sign in & security. Because Intuit uses the account's verification methods to confirm identity during password recovery, keep the recovery phone and email current and under the user's own control; a stale recovery email is a route into the account. See the MFA Guide and the MFA backup codes and recovery codes guide.
Shared logins
Every person should have their own Intuit Account and role. A shared login defeats the audit log, because every change appears under one name, and ties the verification codes to one person's device. Users count against plan limits, which tempts teams to share; the non-billable roles (View company reports, Track time only and accountant users) cover many of the people who only need to look.
Admin roles and privileged access
Intuit's user types article describes these roles for QuickBooks Online. Availability varies by plan, and the custom roles and the sales, expense, inventory and payroll manager roles are part of QuickBooks Online Advanced.
| Role | What it can do (per Intuit) | Security view |
|---|---|---|
| Primary admin | Full access, including permissions and roles; only role that edits business details on the Company tab | Single named owner; two-step verification; documented succession |
| Company admin | Full access including managing permissions and roles; cannot change or reassign Primary admin | Limit to one or two deputies |
| Standard all access | Customers, sales, suppliers, purchases, employees, bank feeds, reconciliations, reports and payroll where subscribed | Broad; can edit suppliers and pay bills, so pair with review |
| Accounts payable manager | Expenses, suppliers, A/P reports, paying bills | Owns supplier payments; should not also approve their own supplier edits |
| Accounts receivable manager | Customers, sales, A/R reports | Good fit for billing staff |
| In-house accountant | Bookkeeping and financial reports; no payroll or admin tasks | Good fit for staff bookkeepers |
| View company reports | All reports except payroll and contact info reports; no transactions or audit log | Use for owners, investors and managers who only review |
| Accountant users | External accountants, up to two free (three on Advanced) | Review at every engagement change |
| Custom user (Advanced) | Roles with access set per area | Build a "supplier maintenance" role separate from "bill payment" |
- Keep admins few: only admins can add, edit or remove admins, so the admin group controls the whole company. Two people is usually the right number: the Primary admin and one company admin for continuity.
- Separate supplier edits from payment: on Advanced, use custom roles so the person who edits supplier records is not the one who pays bills. On other plans, have a second person review the audit log for supplier changes before each payment run. See the Segregation of Duties Guide.
- Review accountant users: remove external accountants when the engagement ends, and confirm each uses MFA on their own Intuit Account.
- Remove leavers on the last day: delete or deactivate the user in QuickBooks and, if they connected apps, take over or disconnect those connections. See the Employee Offboarding Security Checklist.
Integrations, API tokens and service accounts
Payment processors, payroll add-ons, receipt capture and reporting tools connect to QuickBooks Online through Intuit's OAuth 2.0 platform. Each connection is a non-human identity with ongoing access to the company's books. See the SaaS and OAuth App Governance Guide.
Managing connected apps
According to Intuit, only QuickBooks Online admin users can connect and manage apps. To review them, select the Integrations icon and choose Manage integrations; to remove one, select the more icon beside the app, then Disconnect, complete the short questionnaire and confirm. If an app was connected by an admin who has left, another admin can take over the connection through Explore integrations, Get app now and Change Admin, then manage or disconnect it. Accounting firms using Intuit Accountant Suite manage client apps under Apps, Firm apps, where only firm owners can connect and manage them.
OAuth tokens and scopes
| Item | Fact from Intuit's official OAuth client documentation | Governance point |
|---|---|---|
| Accounting scope | com.intuit.quickbooks.accounting | Grants the app access to the company's accounting data |
| Payments scope | com.intuit.quickbooks.payment | Approve only for apps that genuinely process payments |
| Access token | Valid for 3,600 seconds (one hour) | Short-lived; the refresh token is the real credential |
| Refresh token | Use the most recent one; previous refresh tokens expire 24 hours after a new one is issued | Store encrypted and replace on every refresh |
| Revocation | Access or refresh tokens can be revoked through the revoke endpoint | Revoke when an integration is retired, not just delete it from your systems |
If your organisation builds its own integration, keep the app's client secret and refresh tokens in a secrets manager, request only the scopes you use, and revoke tokens when the integration is retired. See the SaaS API Token Security Guide and the OAuth 2.0 and OpenID Connect Guide.
Logging and detection
The audit log (Settings, then Audit log) is the main detection source. Intuit's article states that it records user sign-ins (sign-outs only when the user chooses Sign out), changes to settings, edits to customers, suppliers and employees, payroll submissions, deleted transactions and activity from connected apps, which appears as System Administration events. It filters by user, date changed and event, shows 150 records at a time, needs admin access and keeps events for two years. Per-transaction Audit history, opened from More actions on a transaction, shows who changed what with a Compare Versions view, and is visible to users with full access rights.
| What to look for | Where | Why it matters |
|---|---|---|
| Supplier record edited shortly before a bill payment | Audit log, filter by event and date | Classic supplier bank detail fraud pattern |
| New user or role change, especially a new admin | Audit log, user and settings events | Persistence after an account takeover |
| Sign-ins at unusual times for a user | Audit log, sign-in events | Possible stolen credentials |
| Bill or payment edited after approval | Transaction Audit history, Compare Versions | Changed payee or amount |
| Deleted transactions | Audit log, search for deleted records | Concealment |
| System Administration events from apps | Audit log | App writing data you did not expect |
Two years of retention is generous for a small business, but export or record findings from reviews you rely on as evidence. See the SaaS Audit Log Retention and Licensing Guide.
Metrics
- Admin count: Primary admin plus company admins, kept at two or three.
- Two-step coverage: admins and payment users with two-step verification on, target 100 per cent.
- Supplier change verification: supplier bank detail changes confirmed by call-back before payment, target 100 per cent.
- App ownership: connected apps with a named owner and recent use, target 100 per cent.
- Audit log review: weekly reviews completed and recorded, target every week.
Hardening baseline
- Inventory: list every user and role, identify the Primary admin, list accountant users and their firms, and list every app under Manage integrations with the admin who connected it.
- Authentication: ask every admin and payment user to turn on two-step verification with an authenticator app under Sign in & security, and check recovery phone and email details are current.
- Roles: reduce admins to two, move staff to the narrowest standard role, use View company reports for read-only people, and on Advanced build custom roles that separate supplier maintenance from bill payment.
- Supplier payments: adopt a written rule that any change to supplier bank details is verified by phone to a number already on file and checked by a second person in the audit log before payment. Treat emailed bank change requests as suspect. See the Business Email Compromise Awareness for Finance Teams Guide.
- Apps: disconnect apps with no owner or recent use, take over connections owned by former admins, and record why each remaining app needs its access.
- Review routine: book a weekly 15-minute audit log review covering supplier edits, user changes and deleted transactions, done by someone other than the person who pays bills.
Test a role change with one user before applying it to a team, and roll back by restoring the previous role. Disconnecting an app is reversible by reconnecting it, so disconnect unknown apps first and investigate second.
Small and large organisations
A small business with an owner and a bookkeeper can do this in an afternoon: owner as Primary admin with two-step verification, bookkeeper on In-house accountant or Standard all access, one accountant user, and a call-back rule for supplier changes. A larger finance team on Advanced should define custom roles per function, run quarterly user and app reviews, and assign the weekly audit log review to someone independent of accounts payable.
Common misconfigurations
- Everyone as admin: staff made company admins for convenience, giving each the power to add users and change roles.
- Two-step verification left off: admins relying only on new-device MFA, so a session on a recognised device needs only the password.
- Former accountants still connected: accountant users from past engagements keeping access to the books.
- Orphaned apps: apps connected by an admin who has left, still syncing with nobody watching.
- Supplier edits unreviewed: bank details changed on request and paid in the same week, without a call-back or audit log check.
- Audit log never opened: the evidence is recorded for two years, but nobody looks until after a loss.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A | MITRE ATT&CK |
|---|---|---|---|---|
| Admin and standard roles, custom roles | AC-2, AC-6 | PR.AA-05 | 5.15, 5.18, 8.2 | T1098 Account Manipulation |
| MFA and two-step verification | IA-2, IA-5 | PR.AA-01 | 5.17, 8.5 | T1078.004 Cloud Accounts |
| Connected apps and OAuth tokens | IA-5, AC-6 | PR.AA-01 | 5.17 | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Audit log and audit history | AU-2, AU-6 | PR.PS-04, DE.CM-03 | 8.15, 8.16 | T1213 Data from Information Repositories |
| Supplier bank change verification | AC-6, AU-6 | DE.CM-03 | 5.15, 8.16 | T1657 Financial Theft, T1566 Phishing |
Practitioner checklist
- Confirm the Primary admin is a named owner and reduce company admins to one or two.
- Turn on two-step verification with an authenticator app for every admin and payment user.
- Move each user to the narrowest role and use View company reports for read-only access.
- Remove accountant users and staff who no longer need access.
- Review Manage integrations, assign an owner to each app and disconnect the rest.
- Require call-back verification of every supplier bank detail change before payment.
- Run and record a weekly audit log review of supplier edits, user changes and deleted transactions.
- Store client secrets and refresh tokens for in-house integrations in a secrets manager and revoke them on retirement.
Standards and references
- Intuit QuickBooks: User types and permissions in QuickBooks Online
- Intuit QuickBooks: Use the audit log in QuickBooks Online
- Intuit QuickBooks: View transaction changes in the audit history
- Intuit QuickBooks: Secure your Intuit Account with extra verification methods
- Intuit QuickBooks: Disconnect an app in QuickBooks Online
- Intuit: OAuth 2.0 client for Node.js (scopes, token refresh and revocation)
Related NHI Mgmt Group resources: Invoice Redirection and Supplier Bank Detail Fraud Guide · Business Email Compromise Awareness for Finance Teams Guide · SaaS and OAuth App Governance Guide · Segregation of Duties Guide · SaaS Security Guide