Settings and activity

2 results found

1. Login - Don't Log Me Out/Extend Log Out Time (more than 60 minutes)

   1,130 votes

   vote vote vote vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   vote

   We’ll send you updates on this idea

   415 comments  ·  Users & setup » Login  ·  delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating
   Not in pipeline  ·  AdminKelly Munro (Community Manager, Xero) responded

   Hi everyone, we appreciate the interest surrounding this idea, however we want to be open that we're unable to extend our log-out time past 60 minutes. Xero hold a lot of sensitive information including bank data and we're required to be as secure as online banking.
   Any session information running on a web browser can potentially be stolen. If the session does not time out. You then have an infinitely long vulnerability window to session hijacking. Our best option is to keep a tight expiration window on the session cookie, and regenerate them frequently. Even setting a long timeout doesn't help with this - too long a timeout will greatly increase the risk of invasion or potentially jeopardise your personal data and the safety and integrity of the Xero application itself. This is why we maintain control of this.
   If we detect there's been no activity on a page (e.g move movements, clicks, keyboard) for 10 minutes you'll receive an inactivity prompt ('Hey Kelly, are you still there?') and if your session reaches 60 minutes you'll be redirected to the login page. 

   • As a suggestion you can periodically refresh the screen <F5> to prevent the security timeout kicking in.

   In more recent comments here it sounds like some of you are having issues with the login process or staying logged into Xero for less than 60 minutes. If you're experiencing unexpected behaviour, we'd highly recommend raising a case with our team of specialists at Xero Support where we have tools to investigate and confirm what's going on - Any details you can provide the team on the page you're trying to sign in from (e.g URL, error 500 received) or actions you were making when the login issue occurred will help. Thanks

   Hi everyone, we appreciate the interest surrounding this idea, however we want to be open that we're unable to extend our log-out time past 60 minutes. Xero hold a lot of sensitive information including bank data and we're required to be as secure as online banking.
   Any session information running on a web browser can potentially be stolen. If the session does not time out. You then have an infinitely long vulnerability window to session hijacking. Our best option is to keep a tight expiration window on the session cookie, and regenerate them frequently. Even setting a long timeout doesn't help with this - too long a timeout will greatly increase the risk of invasion or potentially jeopardise your personal data and the safety and integrity of the Xero application itself. This is why we maintain control of this.
   If we detect there's been no activity on a page (e.g… more

   Ray Brindley supported this idea  ·  25 September, 2025

2. Login - Enable Microsoft Entra ID Single Sign On

   722 votes

   vote vote vote vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   vote

   We’ll send you updates on this idea

   287 comments  ·  Users & setup » Login  ·  delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating
   In development  ·  AdminKelly Munro (Community Manager, Xero) responded

   Thanks for your feedback on Single Sign-On(SSO). We last updated this idea in October 2025, and we’re sorry it’s taken some time for us to provide another. We will do our best to keep you more informed of progress as it continues.

   Where SSO is today

   We’ve built an SSO capability for accountant and bookkeeper partner practices using OpenID Connect (OIDC). We ran a closed beta with a small group of partners, which is now complete, and those partners are connected. We’re still confirming how and when other accounting and bookkeeping partners can access it. SSO isn’t currently available to businesses or IT providers. We’ll share access details in a future update once they’re confirmed.

   What we’re looking at next

   We’re exploring what it would take to offer SSO to small businesses. Business needs differ from accountant and bookkeeper partners’, so we’re looking at:

   • how a business and its users are set up in Xero
   • which businesses would qualify
   • how we’d check a company owns its email domain
   • how onboarding and support would work

   Help us understand your needs

   If you run or work in a small business, an accounting or bookkeeping practice, or are an IT provider, please take our short survey. It will give us a sense of how you sign in today, which identity provider you use (if any) and what you need from SSO. It takes about 5 minutes and closes Friday 11 December 2026.

   We don’t have a timeline to share yet. We’ll share an update on the survey findings in the new year (2027).

   Thanks for your feedback on Single Sign-On(SSO). We last updated this idea in October 2025, and we’re sorry it’s taken some time for us to provide another. We will do our best to keep you more informed of progress as it continues.

   Where SSO is today

   We’ve built an SSO capability for accountant and bookkeeper partner practices using OpenID Connect (OIDC). We ran a closed beta with a small group of partners, which is now complete, and those partners are connected. We’re still confirming how and when other accounting and bookkeeping partners can access it. SSO isn’t currently available to businesses or IT providers. We’ll share access details in a future update once they’re confirmed.

   What we’re looking at next

   We’re exploring what it would take to offer SSO to small businesses. Business needs differ from accountant and bookkeeper partners’, so we’re looking at:

   • how a business and its users… more
   An error occurred while saving the comment
   Ray Brindley commented  ·  25 September, 2025  ·  Edit…  ·  delete…

   Still can't believe how utterly pathetic Xero is for this. Every other major vendor can do this why is Xero so utterly inept and insists on insecure methods of authentication.
   Xero is the biggest vulnerability in our organisation because it's the only system that doesn't have SSO.

   Save Submitting...
   Ray Brindley supported this idea  ·  18 April, 2024