Settings and activity
2 results found
-
1,130 votes
Hi everyone, we appreciate the interest surrounding this idea, however we want to be open that we're unable to extend our log-out time past 60 minutes. Xero hold a lot of sensitive information including bank data and we're required to be as secure as online banking.
Any session information running on a web browser can potentially be stolen. If the session does not time out. You then have an infinitely long vulnerability window to session hijacking. Our best option is to keep a tight expiration window on the session cookie, and regenerate them frequently. Even setting a long timeout doesn't help with this - too long a timeout will greatly increase the risk of invasion or potentially jeopardise your personal data and the safety and integrity of the Xero application itself. This is why we maintain control of this.
If we detect there's been no activity on a page (e.g…An error occurred while saving the comment An error occurred while saving the comment 
EMC I.T. Solutions
commented
++ this
EMC I.T. Solutions
supported this idea
·
-
722 votes
Thanks for your feedback on Single Sign-On(SSO). We last updated this idea in October 2025, and we’re sorry it’s taken some time for us to provide another. We will do our best to keep you more informed of progress as it continues.
Where SSO is today
We’ve built an SSO capability for accountant and bookkeeper partner practices using OpenID Connect (OIDC). We ran a closed beta with a small group of partners, which is now complete, and those partners are connected. We’re still confirming how and when other accounting and bookkeeping partners can access it. SSO isn’t currently available to businesses or IT providers. We’ll share access details in a future update once they’re confirmed.
What we’re looking at next
We’re exploring what it would take to offer SSO to small businesses. Business needs differ from accountant and bookkeeper partners’, so we’re looking at:
- how a business and its users…
An error occurred while saving the comment EMC I.T. Solutions
commented
This is very long overdue and for an otherwise great product, this is a glaring weakness/deficiency. Most tech companies implemented SSO with major IDP solutions 4-5 years ago, if not longer.
EMC I.T. Solutions
supported this idea
·
I'm in IT Security, and this isn't the approach you take (We know better than you) unless you want to alienate your user base and cause general discontent.
Allow the organization to adjust this between any defined windows of say, 1-240 minutes. This is an risk management decision at an organizational level. Set the default to 60 minutes but allow each ORG to define their own idle timeout policy.
OR, "lock" the session but don't log it out. I'm sure you're all capable of figuring that out.
Xero's refusal to listen to your customer's is jarring on this, and the SSO enablement both. For an otherwise great product, it's really frustrating.