Universal Login Multifactor Authentication (MFA) for Bullhorn ATS

While passwords are the first line of defense, Multifactor Authentication (MFA) adds an additional step to ensure that only you can access your account. With MFA, even if someone gets your password, they still need a second form of verification to log in. This greatly reduces the risk of unauthorized access and enhances your overall security.

MFA is now required for all Bullhorn clients and can’t be disabled. If your users sign in through SSO, they aren’t prompted for Bullhorn MFA, so we recommend enforcing MFA in your SSO identity provider.

How MFA Works

MFA is supported for both web and mobile login. Follow the steps below for your login method.

Logging In on Web

For a visual demonstration of the web login process, refer to the video here.

Enter your username and password as usual.
An access code will be emailed to you from noreply@bullhorn.com with the subject New Bullhorn Authentication Code, and you'll be directed to the access code screen. If the email doesn't arrive, see Why am I not receiving my MFA access code?
Enter the access code.
You'll be authenticated and redirected to the Home screen.

Logging In on the Bullhorn Mobile App

Before using MFA on mobile, make sure your Bullhorn Mobile App is updated to the latest version.

Open the Bullhorn Mobile App.
Tap Log in with Username.
Enter your username and password.
An access code will be emailed to you from noreply@bullhorn.com with the subject New Bullhorn Authentication Code. Enter it when prompted.
You'll be authenticated and taken to the Home screen.

FAQ

Is MFA required?

Yes. MFA is required for all Bullhorn customers. It was set up on purpose to strengthen account security, so it can't be turned off for individual users or for your company.

Do SSO users need to use Bullhorn MFA?

No. Users who sign in through SSO aren’t prompted for Bullhorn MFA. We recommend enforcing MFA in your SSO identity provider.

Is MFA the same as SSO?

No. They are separate features that serve different purposes:

MFA verifies that you are who you say you are. After you enter your username and password, Bullhorn emails a verification code to the primary email address on your account, which confirms you have access to that email address.
SSO lets you log in to Bullhorn without entering a Bullhorn password by signing in through your company's identity provider, in the same way you might sign in to other company applications.

What verification methods are supported for MFA?

Currently, email verification is the only supported method. When you log in, an access code will be sent to the primary email address associated with your Bullhorn user account.

Does Bullhorn MFA remember my browser so I don't have to verify every time?

No, Bullhorn MFA does not retain browser information. You'll be prompted to enter a verification code every time you log in.

Can I use MFA with the Bullhorn Mobile App?

Yes! MFA is supported on the Bullhorn Mobile App. Update your app to the latest version and tap Log in with Username to be prompted for email verification. SSO users should continue to use Log in with SSO as usual.

Do users need to enter an access code every time they log in?

Yes. Users who sign in with a Bullhorn username and password are prompted to enter the code sent to their email every time they log in. Users who sign in through SSO aren’t prompted for Bullhorn MFA.

How long is the emailed MFA access code valid for?

The emailed MFA access code is valid for 5 minutes (300 seconds). If it expires before you enter it, you'll need to log in again to request a new code.

What email address do MFA access codes come from?

MFA access codes are sent from noreply@bullhorn.com. The email subject is New Bullhorn Authentication Code. Bullhorn does not send MFA access codes from any other address.

Why am I not receiving my MFA access code?

Access codes are sent to the primary email address on your Bullhorn user account. If the email doesn't arrive, work through the steps below. Some steps are for you or your Bullhorn administrator, and some can only be done by your company's own IT team, because only they can see your company's mail system.

Steps for you and your Bullhorn administrator:

Wait a few minutes, then check your spam or junk folder for an email from noreply@bullhorn.com.
Ask your Bullhorn administrator to confirm that the primary email address on your Bullhorn user account is correct.
Remember that an access code is valid for 5 minutes. If it expired, log in again to request a new code.

Steps for your company's IT team:

If the email still doesn't arrive, ask your company's IT or email administrator to check your mail system. Bullhorn can't see your company's email logs or filtering settings, so this check has to come from your side.

Pull the full email trace logs for messages from noreply@bullhorn.com to the affected user. Look at the delivery status: delivered, deferred, rejected, or redirected.
Check whether an email security gateway or scanning tool is intercepting the message. These tools can redirect, modify, or drop an email before it reaches the inbox, sometimes without creating a quarantine entry.
Temporarily allowlist noreply@bullhorn.com and the subject New Bullhorn Authentication Code, then try logging in again.

When to contact Bullhorn Support:

If your IT team completes these checks and the access code still doesn't arrive, contact Bullhorn Support and include the email trace logs from your IT team.

Bullhorn can't turn off MFA to work around an email delivery issue. Contact your IT team to resolve the delivery problem so users can log in with MFA.

Does MFA apply to API users?

No, API users accessing Bullhorn via the REST API will not be prompted for an MFA access code. MFA applies to standard user accounts only.