Enter your idea

I would like the option to "trust this device" for 30 days. Like Myob has always had!

I WFH and no one has access to my device, yet I am interrupted several times a week during the day to re-log into Xero with an auth code. its most annoying.

To explain the absolute hatred I have for the Xero login experience:

If there is another accounting solution available in the market that allows me to stay logged in, I would switch to that solution in a heartbeat, regardless of almost any other features.

I disagree with this decision. I am being logged out multiple times per day, and selecting the option to remember my MFA choice for 24 hours does not work at all. This makes the new login experience unnecessarily disruptive and defeats the purpose of providing a 24-hour remember option.

Your response that defaulting the checkbox has been considered but cannot currently be implemented does not adequately address the issue. I am raising two distinct concerns:

- Remember the user's choice: The system should retain my explicit choice to remember my MFA preference across subsequent login sessions, rather than requiring me to tick the checkbox every time I log in.
- Make the 24-hour option work: When selected, the preference should be honoured reliably for the full 24-hour period, subject to legitimate security requirements.

To be clear, I am not asking for the checkbox to be automatically selected by default. I am asking for the system to remember the choice I have already made and respect that preference across sessions.

Repeated logouts and unnecessary MFA prompts interrupt workflows, waste time and undermine the purpose of offering a 24-hour remember option in the first place. If the preference is not retained or honoured, this is either a functionality issue or a failure to deliver a reasonable user experience. Neither should simply be deferred as a potential future improvement.

Please reconsider this decision and provide a substantive response addressing why the user's explicit preference cannot be retained across sessions, whether the current behaviour is a known defect, and what steps will be taken to ensure the 24-hour option works as intended.

Acknowledging the suggestion without addressing the underlying functionality is not a resolution.

Agreed — this is such a bizarre implementation of the "Trust this device" feature.

I've only started using Xero recently and this is doing my head in too. It should be 30 days, not 30 minutes. Sometimes I'm entering it multiple times if I forgot to check that box. Please get this fixed asap.

Have to log in multiple times a day with 2FA is very frustrating.

I agree, it's incredibly annoying! Would love for it to last sometime.

Logging into xero is very annoying because everytime it asks for 2FA code even for trusted devices. It doesnt remember the device even when we press trust device

2FAQ is extremely annoying. My bank accounts are easier to log n. Cin7 only required authentication every 30 days, Xero is constant and a big waste of time. If there was another software option that was not this annoying, we would switch

"Trust this device" for 7 or 30 days (like Myob)

I am tired of having my work flow interupped to enter 2FA at random times in the middle of the day. Could we have Trust this device for longer than 24 hours??

Over time it gets really really annoying to do this on a daily basis.

I tick trust this device and it constantly logs me out multiple times per day while I am using other software programs and despite using the same device and WiFi connection. This is so very frustrating.!

I cannot agree more with everyone who has posted here. Xero is the only platform/system where the "Trust my device" literally does NOT mean "Trust my device". The frustration in constantly logging into the same desktop through two devices results in me accessing and using Xero less. Can the Xero developers not just follow (almost) all other app environments and grant trusted access? (Do the developers actually read and take our ideas on board? Anyone in here from Xero?)

Agreed - why the 24 hours when this is a private only used PC and yet the trust only lasts for 24 hours - ridiculous.

How about the phrase is changed to;

Trust this device for 24hrs.

That way it would be clear it is *just 24hrs*.

('Trust this device' on most any other SaaS product usually means 30 days, not 24hrs)

Can't explain just how much this drives me crazy to have to log in on my home computer and trust this advice but then the advice is not trusted. It's a stupid system and is massive overkill. Banking doesn't even make us jump through this many hoops. I'm all for security but this is ridiculous and unnecessary.

This drives me insane. What's the point of having a trust this device if it resets every single day? Defeats the purpose. What a frustrating thing to do each time I want access.

When I open the app on my phone, it remembers my password and I'm straight in. Why do I need to use the authenticator app on my phone to enable the computer to log in? Isn't the purpose of multifactor authentication to detect if it's a new device and if so THEN require another verification step. I'm VERY frustrated that I need to use the authenticator app everyday!

Xero has the most aggressive MFA of any software platform I use (BY FAR), including that of my bank.

Please allow users (or admins) the option to relax MFA timeout.

@Koti,
It used to work like 1 and 3 (30 days) then they changed it to work like 1 and 3 but only for 24 hours.
They won't go back to 30 days...
What I want in lieu of that is for them to keep the box ticked (if I tick the box), so that when I am forced to use MFA on logging in >24h later, I don't have to tick the box again and I won't have to use MFA again for 24h (unlike now, where I do, if I forget to tick the box when logging in on day 2)

I work as a senior Identity and Access management consultant. And my recommendations are below,
1. If a user checks the box - trust my device then trust the device and skip MFA for next login
2. If the duration of next login is more than 3 days ideally considering the weekend, ask for MFA again else keep skipping the MFA. This is like Idle time in the login behaviour.
3. Consider refreshing MFA every 30 days. This means even if the user is regularly logging in force them to MFA after 30 days. This is max MFA duration.

I can provide clearer instruction if required.

Cheers.