Blog Post

MYOB Announcements

5 MIN READ

Enhanced security measures are live - 27/11/24 (Update 19/12/24)

Admin

4 months ago

Hi everyone,

Update 19/12/24 - Are you still there?

Hello Community members and followers of this security updates thread! Its been a few days since we last spoke.

There is a great update coming through already for the inactivity timeout changes in the browser. AND its releasing Today the 19/12/24.

Users in the browser will now be provided with a warning message 5 minutes prior to the inactivity timeout.
This will show at the top of the window with "Are you still there?" and provides a clickable option to confirm "I'm still here" - example image below

Update 05/12/24: Session Inactivity Lock for AccountRight Desktop App

We've consulted with the ATO and have been able to agree that AccountRight Desktop can be excluded from the 30 minute inactivity lock requirement. We can confirm this feature has now been removed from the desktop app.

While the inactivity lock is no longer in place on the AccountRight desktop app, we strongly encourage everyone to implement sensible security measures on your individual devices. This includes setting up automatic timeouts and using password-protected logins for added protection.

The 30-minute inactivity lock will remain in place for MYOB Business and MYOB AccountRight in the browser, in line with ATO requirements.

Previous update to this post (27/11/24)
The changes for inactivity went live today on the 27th November.
Specifically for AccountRight, many customers encountered unexpected crashing/freezing of the software after entering their password to sign in again. Work in progress would also be lost due to the crash.

I want to assure everyone that this is not the expected behaviour associated with the inactivity timeout. You can expect the screen to blur and a message pop up. Click sign in again as [user]. Enter your password and you will be back to continue where you were (no loss to work in progress)

As a result of the crashing, we have temporarily disabled the inactivity timeout for AccountRight, you will need to close and re-open AccountRight for this change to take effect.

Thank you for the feedback, examples and information provided on these issues today. We are continuing to investigate before it is enabled again.

I’m updating this post (2:30pm AU 21/11/24), as there have been a lot of comments and engagement in the change.
With over 100 comments on the post, we are starting to get the same questions being asked, and answers being missed so I hope to summarise the change and key questions/feedback here.

The change/s and timeline

September 30^th > MYOB implemented 2FA being required at least once every 24 hours
- Some initial feedback came through about the 2FA prompt caused customers to lose work in progress
- MYOB has implemented a fix based on feedback and 2FA is prompted on the first login each day to avoid loss of work

November 27^th > you'll be asked to sign back in after 20-30 minutes of inactivity (announced November 19^th)
- This announcement on inactivity is driving a significant amount of feedback and discussion that I will summarise below

What’s changing:

From Wednesday 27 November 2024, you’ll be asked to sign back in after 20–30 minutes of inactivity. After this time, your screen will become locked and blurred. To continue working, you'll need to sign back in with your username and password. This applies to the following MYOB software: MYOB Business, MYOB AccountRight and AccountRight browser (online files only), MYOB Connected Ledger, MYOB Business Payroll Only and MYOB Practice.

Browser:

Desktop:

What do you need to do?

When you’re presented with the Are you still there? message we recommend that you click Sign in using [existing email] to return to work in progress.
Note* 2FA is not required as part of signing in again and your email will automatically be pre-filled

Will I lose my work when the screen is greyed out?

If you sign back into your account using your existing email, you won’t lose any work in progress and can continue where you left off. However, if you choose to sign in to a different account, your work will not be saved.

If you click Back or Reload, or if you don’t sign back in after 12 hours, you'll also lose work in progress.

How does the inactivity screen work between Browser and Desktop?

When you are logged into both the Browser and Desktop at the same time, each session will operate independently. This means that if you are inactive in the Desktop version, you can remain active in the Browser version. The inactivity timeouts for these sessions are separate from one another.

When signing back in after inactivity, do I have to enter my email, password and do 2FA?

No, your email will be automatically pre-filled when signing back in using your existing email to both the desktop and browser software. Users will be required to enter their password only. 2FA is still a 24-hour requirement and not required for signing back in after an inactivity timeout.

Can I opt out of the new inactivity or 24-hour 2FA security measures?

No, as these are mandatory compliance changes in line with industry best practice, they cannot be disabled

Why am I being asked to login or do 2FA multiple times a day?

Based on scenarios described in the forum + a known issue that MYOB is currently working to resolve, this could be for one of the following reasons.

Closing AccountRight using the ‘x’ is currently causing 2FA to be prompted when re-opening the software even if it is less than 24 hours. This was recently discovered as a bug/regression with the last AccountRight 2024.10 release and the team are releasing a fix to this asap. This has been resolved*
Opening multiple instances of AccountRight. This seems to something multiple customers are doing when they have multiple files they work on. Instead of switching between files (no login would be required) they are all opened concurrently and each instance of AccountRight that is opened will require a login

Is this an MYOB decision or required by the ATO? And subsequently, why do New Zealand customers need to adhere to ATO requirements?

Yes, both the 24 hour 2FA and the inactivity timeout changes are mandated requirements from the ATO. This requirement seeks to minimise the opportunity for unauthorised users to access Taxation, Accounting, Payroll, Business Registry or Superannuation related information. Read more on the ATO website here if interested
New Zealand customers, although not bound by the same requirements set by the ATO, will share the same security measures as our Australian customers so that MYOB is providing best practice security to all customers.

MYOB has also published help articles that explain the changes and can be found below

For Australian customers here
For New Zealand customers here

Updated 5 days ago

Version 10.0

announcements

Tips

MikeG1

Admin

Joined October 29, 2021

View Profile

MYOB Announcements

The latest news and happenings on the MYOB Community Forum.

PeterEPNZ
Cover User
2 months ago
Sorry if this has already been asked, but there are a lot of comments here! I also feel frustrated by this, but there is one major concern I do have - if we leave a MYOB file unused for 20-30 minutes (and when you are working on 5 MYOB files concurrently like I do this is going to happen...ALOT...) - please MYOB can you confirm, will our working windows be restored? Will the work be auto saved? What if we are entering invoices with 150 line items and it logs out - do we lose all that work? Or if it auto saves this, this could be almost worse as then we run the risk of having duplicate entries all over the show - MYPB please respond to this, I wish to know precisely how this new (frutrating) logout is going to impact our day to day entries.
- MikeG1
  Admin
  2 months ago
  Hi PeterEPNZ , definitely a lot of comments, dont blame you there!
  Im going to update the main post to be more of a Q&A type post based on all of this feedback soon
  
  With regards to work in progress, you must sign back as the same email/user to return to work in progress. See below from the help article:
  
  If you’re presented with the Are you still there? message, click Sign in using [existing email] to return to what you were working on in AccountRight.
  
  For example, if you were in the middle of entering an invoice in the Sales window when you received the inactivity blur screen, you'll be returned to the Sales window when you sign back in with your email address, able to continue where you left off.
  
  If you choose to sign back in with a different MYOB account, click Log in as a different user and sign in with that account. Any work in progress will be lost. If you click Exit or, when using AccountRight browser, Back or Reload, or if you don’t sign back in after 12 hours, you'll also lose work in progress.
Artemis7000
2 months ago
Wow, this whole situation is just (well almost) laughable!
This would be the same ATO who, when they were breached in July 2022, denied all knowledge and then said it wasn't them, then blamed MyGov. They released hundreds of thousands of dollars to criminals by paying bogus "tax returns" to suspect bank accounts, then took it out on the clients and accountants. Over two years later they STILL have not fixed the problems, and thousands of people now have to wait on hold while the ATO manually "unlocks" their file so they can submit a tax return!!
The ATO's way of dealing with this is to place restrictions on software users (and software companies) by placing unreasonable demands on their so-called "security".
What a laugh!
MickyH75
Experienced User
2 months ago
I've just had one of my users tell me they've been timed out twice today even though this isn't supposed to start till 27/11. We use the desktop version and had the forced update come through yesterday.
- AmandaCL
  MYOB Moderator
  2 months ago
  Hey MickyH75
  
  I can confirm these changes won't take place until the 27th of November. It sounds like they may have received an application operation timeout error? If so, this forum post has instructions on how to run the Timeout Extender for MYOB AccountRight. Hope that helps, feel free to reach out if you have any further questions.
Lisa_BBP
Trusted Cover User
27 days ago
This is the worst move that MYOB have made to date. I understand 2FA security measures however logging out after 20-30 minutes is too extreme. I work with multiple MYOB files at once and it seems that I am spending more time logging in to the file than doing actual work. This is absolute madness!
MikeG1
Admin
27 days ago
Good morning all,

As everyone is aware, these changes have gone live
I want to call out that there have been multiple comments about peoples software freezing and needing to restart after logging back in.

Based on this, we have temporarily disabled the inactivity timeout for AccountRight while we look into this.
Edit You will need to restart AccountRight to pick up the change that we have disabled this

We do not know if this is related to the inactivity change or not yet and are investigating.
Thanks for your engagement and feedback to help manage the change. Mike
- 483960
  27 days ago
  no you haven't disabled it yet.
  My MYOB froze 15 minutes ago. I couldn't do anything. I had to restart my laptop and lost work on Word and Excell files.
  What a stupid idea- freezing your accounting system every 20-30 minutes.
  The idiot who came up with this idea, obviously does not run a business and has no idea how a business runs.
  At least give the customer a choice whether to activate it or not!
  - MikeG1
    Admin
    27 days ago
    Thanks for letting me know, I have updated my post, sorry you will need to close AR to pick up the change that we have rolled back.
    I will private message you for your file information to help our investigation. Thanks!
MAS2
Experienced User
27 days ago
This new security of having to log back in every 20 min is painful & time consuming, I have 3 businesses that I use MYOB for so am back and forth to each business. Please let us have a choice to opt out or at least for 24 hours so we can choose when we first sign in for the day. We are busy enough without having to do this numerous times a day!
Louise_xoz
Experienced User
27 days ago
It's crashing all the time since you introduced this "feature."

Why not make this resume optional for each case?
- AmandaCL
  MYOB Moderator
  27 days ago
  Hey Louise_xoz
  
  We are aware of issues customers are facing trying to open their files this morning. We have temporarily disabled the inactivity timeout for AccountRight while we look into this and you will need to restart AccountRight to pick up the change. At this point we are unsure if it's related to the inactivity changes but will make sure to update you as soon as I have more information.
  - Louise_xoz
    Experienced User
    27 days ago
    Make this "feature" optional for each user to decide. You've stuffed it up yet again.
PortPhillipBoat
Contributing Cover User
27 days ago
Anyone else having the issue that when you log back in after inactivity there becomes a connection problem and you have to exit and log back in?
This is not what MYOB told us would happen.
the reasoning was to protect Payroll that goes to ATO, and if a user doesn't have access to payroll due to the role setup they have, then why make them log in after 30 minutes?
Causing a LOT of DOWNTIME and frustration.
MYOB, you need to look at how you have developed this and consequences to product and productivity
- MikeG1
  Admin
  27 days ago
  Hi PortPhillipBoat , there are a lot of comments here so its easy for information to get lost.
  The connection problem is definitely not expected. We dont know if this is directly related to the inactivity changes but we have removed the inactivity timeout from AccountRight while we investigate.
  You will need to close and re-open AccountRight to pick up the change that we have removed this
  - Turtlewitnohome
    Experienced Cover User
    27 days ago
    Why haven't you updated the original post with this imformation?
Louise_xoz
Experienced User
26 days ago
I'm sure that with over 250 negative response you can say MYOB has been told!
MickyH75
Experienced User
26 days ago
MikeG1I guess what I and many others are struggling to understand is what is trying to be secured by this change?

The only risk that I see is that someone changes a supplier or employee bank account and we make a payment to a fraudulent account via a file payment. In the 21 companies that I look after only 8 are set up for file payments and the only people that can change bank account details are the admins (there are 3 of us). We all have to email each other if we're going to make a change before receiving the MYOB automated email. If we receive the MYOB email without warning we will question the others to see who did it.

From a payroll perspective, other than the admins, only 1 person has access to payroll information so could see TFNs and that is only in 1 of the 5 entities that have active payroll. An admins manages payroll for the other 4 entities.

Other than that I could care less is someone hacks us and sees our info. We make back ups periodically so at most we'd lose a couple of months worth of data if there was a breach and someone managed to lock our files.