Enter your idea

It's great to see this getting more attention from the community.

Hopefully the Xero Team takes notice.

More to the point, the Australian government ACSC Essential8 now requires it.

We are implementing the Australian ESSENTIAL 8 security measures. Can we have single sign on so we can use phishing resistant MFA & log MFA failure? https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model

We are also likely needing to switch platforms this year as a result of this missing feature. This is disappointing as we have been a Xero customer since 2012.

Please add this Xero - it's crazy that this has been on the Ideas Board since 2013 and has a huge number of votes.

It's such an easy implementation for a dev team to roll out and dramatically improves the security of Xero and opens up the customer base to anyone under ISO27001 etc.

Another publicly listed company not taking security seriously.

Just disappointing really.

It won't be long before they make the news.

This is so frustrating that Xero does not support basic security features in 2025.

Any planned support for Okta / SAML?

We're planning iso27001 and this will be a deal breaker. If its not on the 2025 roadmap, we'll need to leave the platform.

This is an absolute requirement moving forwards.

we are currently attaining ISO 27001 and this is a requirement.
Its not a nice to have its a must have.

As the push towards Passkeys kicks into high gear in 2025, Xero is way behind here. Most small businesses have Google Workspace or Microsoft 365. These are some of the most secure authentication methods because they've been pushing their users towards 2FA and now Passkeys. At the very least there should be native Passkey support, but ideally, SSO/SAML support for the like of Google. Microsoft, Okta, and Duo. This is the only 'major' app in our business stack that still relies on direct password authentication. Everything else is Passkeys or Google SSO Auth.

Please please pretty please

I concur with Adam.

I work for an ISO 27001 consultancy, and Xero appears on many of our clients' risk registers for this.

Given QuickBooks Online doesn't appear do this either, implementing it would give Xero a marketable USP in the small business space to pick up the SMB's that take cybersecurity seriously (which is a large chunk) and hoover up some of QB's market segment.

I don't know if the reticence is the complexity of implementing it, or the expected time commitment to supporting users afterwards, but the demand for it isn't' going to go away ... and if Xero can't deliver, I can see some of our customers moving away to other solutions that do (and as a consultant, I can't blame them either).

Here we are, 11 years on with no traction.

Xero is specifically highlighted in our cyber risk register due to its lack of integration with external identity providers.

For us, it is critical to have user integration.

Hey team, I think adding Single Sign-On (SSO) to Xero would be a fantastic enhancement for all of us. SSO allows users to access multiple applications with just one login, making our daily tasks smoother and reducing the hassle of remembering multiple passwords. Plus, it aligns with the National Cyber Security Centre (NCSC) guidelines for strong authentication methods, which means better security for our data.

Many other products already offer SSO as a standard feature, so incorporating it into Xero would help keep the platform up to date with industry standards. It also supports compliance with schemes like Cyber Essentials, showing a commitment to best practices in cybersecurity. It would be great to see Xero take this step to protect its users and make our experience even better.

Spin Doctor Kelly. Please don't sell this as an idea.

Hi Kelly, I note in your reply you acknowledge the 'operational risk' that businesses are attempting to minimize. Not sure why Xero would want their product as part of the problem instead of part of the solution? I strongly agree with the request of other users that this is implemented.

Yes please prioritise this, this is an important step for many organisations security.

Critical for security in this day and age. please prioritise development