Settings and activity
2 results found
-
699 votes
Hi everyone, we appreciate all the feedback and votes on this idea. We know using Microsoft Entra ID SSO is now common practice for some businesses and being able to access Xero via a native integration with Entra ID would streamline how your teams log in and get set up in Xero, as well as help in managing access for larger teams and keeping things secure.
Our product team have been working with a small limited group of Partners to develop SSO capabilities. Though we can't give any definite timelines yet, we’ll keep this thread updated with news. Thanks
An error occurred while saving the comment An error occurred while saving the comment 
James Bonifield
commented
SSO is nearly 21 years old as a feature if we consider SAML 2.0, the most widely implemented protocol (OIDC is better). I would ask the simple question - would Xero buy a software that doesn't support SSO themselves? Probably the answer as no (I hope the answer is no). This should not come as a surprise to Xero employees as you log in every day using SSO -> xero.okta.com
Self-service SSO is non-trivial, but not *that* hard, certainly considering how long this has been swirling the drain. You are probably trying to implement with Okta currently:
1. Create a couple APIs for your application that call the Okta management API in your external Okta tenant for the SSO config
2. Throw a SSO management page in your front end that manages this for admins
3. Profit: Upcharge your customers for "security" features that should really be freeIf you need help DM me and I will literally build this for free for you. This feature request is so old it is almost now a teenager at 13 years old - wake up!
An error occurred while saving the comment James Bonifield
commented
I am looking at moving off Xero, as it is ridiculous that SSO support is not provided, and as a provider of Identity & Access Management services it's sort of a deal breaker to use software that doesn't provide this fundamental security benefit.
By the way - as an enterprise software provider - you should be mindful of CISA's Secure By Design Framework and the myriad other frameworks that you are not in compliance with by not providing SSO (even behind a paywall, which is a separate conversation, but at least it's offered)
If you need help implementing shoot me an email - james@anthropicidentity.com I work in IAM and have implemented SSO many times. How easy it is to do this vs the impact it has on the maturity of your software makes me a little shocked you still don't have it in place
James Bonifield
supported this idea
·
-
92 votes
Hi team, we've just launched passkeys to our first group of users. From this week, Xero Me app users who haven't set up MFA yet will be able to use passkeys to log into Xero. Next, we'll be progressively rolling this out to more users over the coming months. We look forward to and welcome your feedback here. As we have more news on the rollout I'll share with you on this idea.
An error occurred while saving the comment James Bonifield
commented
Passkeys are a decent alternative to the embarassing lack of SSO. Stop wasting time with AI agents and JAX that no one asked for and provide for basic security features
James Bonifield
supported this idea
·
Consider this as a data point: I am moving to QBO on Sept 1, 2026 if there is not clear indication and prioritization from the product team. I’ll be back to post about this on this date, as it seems almost certain Xero will continue to prioritize shiny objects over user security. It’s embarrassing that you haven’t built this capability which is frankly, really not that hard to do. You don’t even need to build a connector with Entra or Okta, just a page to generate SAML metadata and support self service federation setup. That’s Claude code max + a week of adult supervision + regression testing.
Xero - if you read this - email me at James@apivant.io and I will have my team build the connectors for Okta and Entra for you. I’m not joking. You just have to do the self service SSO set up and metadata exchange piece. I’d be happy to help you build this foundational feature which is a bare minimum for enterprise software.
Also - I strongly agree with Andrew’s point below - it’s a great idea to build out connectors for popular IDPs, but you must support SAML or OIDC generically.
James Bonifield
CEO & Founder, Apivant