Thanks for your feedback on Single Sign-On(SSO). We last updated this idea in October 2025, and we’re sorry it’s taken some time for us to provide another. We will do our best to keep you more informed of progress as it continues.
Where SSO is today
We’ve built an SSO capability for accountant and bookkeeper partner practices using OpenID Connect (OIDC). We ran a closed beta with a small group of partners, which is now complete, and those partners are connected. We’re still confirming how and when other accounting and bookkeeping partners can access it. SSO isn’t currently available to businesses or IT providers. We’ll share access details in a future update once they’re confirmed.
What we’re looking at next
We’re exploring what it would take to offer SSO to small businesses. Business needs differ from accountant and bookkeeper partners’, so we’re looking at:
how a business and its users are set up in Xero
which businesses would qualify
how we’d check a company owns its email domain
how onboarding and support would work
Help us understand your needs
If you run or work in a small business, an accounting or bookkeeping practice, or are an IT provider, please take our short survey. It will give us a sense of how you sign in today, which identity provider you use (if any) and what you need from SSO. It takes about 5 minutes and closes Friday 11 December 2026.
We don’t have a timeline to share yet. We’ll share an update on the survey findings in the new year (2027).
Thanks for your feedback on Single Sign-On(SSO). We last updated this idea in October 2025, and we’re sorry it’s taken some time for us to provide another. We will do our best to keep you more informed of progress as it continues.
Where SSO is today
We’ve built an SSO capability for accountant and bookkeeper partner practices using OpenID Connect (OIDC). We ran a closed beta with a small group of partners, which is now complete, and those partners are connected. We’re still confirming how and when other accounting and bookkeeping partners can access it. SSO isn’t currently available to businesses or IT providers. We’ll share access details in a future update once they’re confirmed.
What we’re looking at next
We’re exploring what it would take to offer SSO to small businesses. Business needs differ from accountant and bookkeeper partners’, so we’re looking at:
Xero… It’s time you woke up to the risks of MFA compromise and token theft and enable the ability for your customers to include Xero within their own Zero Trust framework.
If you need convincing please check up on the following:
This is something Xero should be using themselves to improve their own security and by the fact this is not high on your agenda for your customers leaves me thinking you are not applying best in class security across your own infrastructure.
Edit: Oh and please update the purpose on the initial request as it’s more about security and not just user experience.
Also, do not expect a large number of up votes for such a request as not many users will see the need for additional layers of security, yet targeted phishing attacks are on the rise and this is a high agenda item for any company who takes security seriously.
Nigel Clark
supported this idea
·
Xero… It’s time you woke up to the risks of MFA compromise and token theft and enable the ability for your customers to include Xero within their own Zero Trust framework.
If you need convincing please check up on the following:
Zero Trust: https://www.microsoft.com/en-us/security/business/zero-trust
Conditional Access Policies: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
MFA token theft: https://www.menlosecurity.com/blog/the-art-of-mfa-bypass-how-attackers-regularly-beat-two-factor-authentication
This is something Xero should be using themselves to improve their own security and by the fact this is not high on your agenda for your customers leaves me thinking you are not applying best in class security across your own infrastructure.
Edit: Oh and please update the purpose on the initial request as it’s more about security and not just user experience.
Also, do not expect a large number of up votes for such a request as not many users will see the need for additional layers of security, yet targeted phishing attacks are on the rise and this is a high agenda item for any company who takes security seriously.