Our production site, as well as our QA servers, are all having an issue with passing the 2-factor authentication in admin panel.
When a newly created admin user scans the QR code after providing their username and password, and enters the 6-digit code shown on the Google Authenticator app, they are consistently given an "Invalid code" error message. However, if an existing admin resets their Google Authenticator 2FA settings under User Accounts, the new user can scan the QR code and enter the 6-digit code with no issue. This is not happening on any old accounts, only new ones.
This issue is not reproducible on local environments.
There was a similar question asked earlier but the OP himself had to reset the 2FA in the accepted solution. This should ideally work without resetting the 2FA.
We are running Magento Commerce/Enterprise version 2.3.5-p1 while the msp/twofactorauth
package is at version 3.1.2