Mandatory 2FA Now Enforced for Integration Access to NetSuite
NetSuite began enforcing the mandatory two-factor authentication (2FA) requirement in all NetSuite accounts as of 2018.2. By default, the Administrator and other highly privileged roles are designated as 2FA required, and this requirement cannot be removed. Any standard or customized roles subject to the 2FA requirement are indicated in the Mandatory 2FA column on the Two-Factor Authentication Roles page.

Integrations that employ user credentials to access NetSuite may be subject to mandatory 2FA in the following situations:
- NLAuth for RESTlets. For more information, see the help topic Using User Credentials for RESTlet Authentication.
- SuiteTalk (web services) integrations that use the login operation. For more information, see the help topic login.
- SuiteTalk (web services) integrations that use the passport element sent as Request Level Credentials (RLC). For more information, see the help topic Request-Level Credentials.
- Inbound SSO integrations that use the mapSso operation. For more information, see the help topic mapSso.
Your integrations must use certain functions that require a highly privileged
role. You should transition these integrations to use token-based authentication (TBA) rather than user credentials, or specify a less-privileged role that does not require 2FA. For more information, see the help topic Token-based Authentication (TBA). For information about using TBA with your integrations, see the help topic Integration Management.
Setting Up Token-based Authentication Roles
https://netsuite.custhelp.com/app/answers/detail/a_id/82075
OAuth Library Consumption for Client Application
https://netsuite.custhelp.com/app/answers/detail/a_id/42171