Blog Post

MYOB Announcements

5 MIN READ

Enhanced security measures are live - 27/11/24 (Updated messaging 05/12/24)

MikeG1

Admin

3 months ago

Hi everyone,

Important Update 05/12/24: Session Inactivity Lock for AccountRight Desktop App

We've consulted with the ATO and have been able to agree that AccountRight Desktop can be excluded from the 30 minute inactivity lock requirement. We can confirm this feature has now been removed from the desktop app.

While the inactivity lock is no longer in place on the AccountRight desktop app, we strongly encourage everyone to implement sensible security measures on your individual devices. This includes setting up automatic timeouts and using password-protected logins for added protection.

The 30-minute inactivity lock will remain in place for MYOB Business and MYOB AccountRight in the browser, in line with ATO requirements.

Previous update to this post (27/11/24)
The changes for inactivity went live today on the 27th November.
Specifically for AccountRight, many customers encountered unexpected crashing/freezing of the software after entering their password to sign in again. Work in progress would also be lost due to the crash.

I want to assure everyone that this is not the expected behaviour associated with the inactivity timeout. You can expect the screen to blur and a message pop up. Click sign in again as [user]. Enter your password and you will be back to continue where you were (no loss to work in progress)

As a result of the crashing, we have temporarily disabled the inactivity timeout for AccountRight, you will need to close and re-open AccountRight for this change to take effect.

Thank you for the feedback, examples and information provided on these issues today. We are continuing to investigate before it is enabled again.

I’m updating this post (2:30pm AU 21/11/24), as there have been a lot of comments and engagement in the change.
With over 100 comments on the post, we are starting to get the same questions being asked, and answers being missed so I hope to summarise the change and key questions/feedback here.

The change/s and timeline

September 30^th > MYOB implemented 2FA being required at least once every 24 hours
- Some initial feedback came through about the 2FA prompt caused customers to lose work in progress
- MYOB has implemented a fix based on feedback and 2FA is prompted on the first login each day to avoid loss of work

November 27^th > you'll be asked to sign back in after 20-30 minutes of inactivity (announced November 19^th)
- This announcement on inactivity is driving a significant amount of feedback and discussion that I will summarise below

What’s changing:

From Wednesday 27 November 2024, you’ll be asked to sign back in after 20–30 minutes of inactivity. After this time, your screen will become locked and blurred. To continue working, you'll need to sign back in with your username and password. This applies to the following MYOB software: MYOB Business, MYOB AccountRight and AccountRight browser (online files only), MYOB Connected Ledger, MYOB Business Payroll Only and MYOB Practice.

Browser:

Desktop:

What do you need to do?

When you’re presented with the Are you still there? message we recommend that you click Sign in using [existing email] to return to work in progress.
Note* 2FA is not required as part of signing in again and your email will automatically be pre-filled

Will I lose my work when the screen is greyed out?

If you sign back into your account using your existing email, you won’t lose any work in progress and can continue where you left off. However, if you choose to sign in to a different account, your work will not be saved.

If you click Back or Reload, or if you don’t sign back in after 12 hours, you'll also lose work in progress.

How does the inactivity screen work between Browser and Desktop?

When you are logged into both the Browser and Desktop at the same time, each session will operate independently. This means that if you are inactive in the Desktop version, you can remain active in the Browser version. The inactivity timeouts for these sessions are separate from one another.

When signing back in after inactivity, do I have to enter my email, password and do 2FA?

No, your email will be automatically pre-filled when signing back in using your existing email to both the desktop and browser software. Users will be required to enter their password only. 2FA is still a 24-hour requirement and not required for signing back in after an inactivity timeout.

Can I opt out of the new inactivity or 24-hour 2FA security measures?

No, as these are mandatory compliance changes in line with industry best practice, they cannot be disabled

Why am I being asked to login or do 2FA multiple times a day?

Based on scenarios described in the forum + a known issue that MYOB is currently working to resolve, this could be for one of the following reasons.

Closing AccountRight using the ‘x’ is currently causing 2FA to be prompted when re-opening the software even if it is less than 24 hours. This was recently discovered as a bug/regression with the last AccountRight 2024.10 release and the team are releasing a fix to this asap. This has been resolved*
Opening multiple instances of AccountRight. This seems to something multiple customers are doing when they have multiple files they work on. Instead of switching between files (no login would be required) they are all opened concurrently and each instance of AccountRight that is opened will require a login

Is this an MYOB decision or required by the ATO? And subsequently, why do New Zealand customers need to adhere to ATO requirements?

Yes, both the 24 hour 2FA and the inactivity timeout changes are mandated requirements from the ATO. This requirement seeks to minimise the opportunity for unauthorised users to access Taxation, Accounting, Payroll, Business Registry or Superannuation related information. Read more on the ATO website here if interested
New Zealand customers, although not bound by the same requirements set by the ATO, will share the same security measures as our Australian customers so that MYOB is providing best practice security to all customers.

MYOB has also published help articles that explain the changes and can be found below

For Australian customers here
For New Zealand customers here

Updated 48 minutes ago

Version 9.0

announcements

Tips

MikeG1

Admin

Joined October 29, 2021

View Profile

MYOB Announcements

The latest news and happenings on the MYOB Community Forum.

Mark-D
2 months ago
We have multiple desktops in a retail store where staff operate from but not allowed their phones on the floor and their emails are only at their main desk. To sign in now they need to run back to their main desk to get code then go back to that desktop and sign in.
Even when i was working from my desktop and signed in on another desktop in the retail space i still needed the code to login in, thus creating more downtime and frustration for the customer.
There needs to be an option for the user to remove this sign in option.
Artemis7000
2 months ago
The MYOB minders have gone bonkers with these latest changes. It has nothing to do with real security but just MYOB covering their backsides in case someone has a breach.
Even this forum now needs to have 2FA access - are MYOB frightened their competitors will see the negative comments?? Like most others who comment on this topic, give users the ability to structure their security the way they wish!
- MikeG1
  Admin
  2 months ago
  Hi Artemis7000 , the majority of content in this community forum can be viewed without logging in. You only need to be signed in to post/like/comment etc.
  To make it easy for our customers to register, the community forum has always been linked with the MYOB single sign-on therefore the same authentication rules also apply.
  Hope this helps
RebeccaT1
2 months ago
Is there any way to turn it off?
H-TS
Trusted User
16 days ago
I sure hope the 20-30 minute inactivity relogin will at least save the email address! This is insane. Fair enough for internet banking and the like but really? My screensaver has a password and that kicks in after 5 minutes. I don't need this. Please, please, make it optional, or allow us to set the time ourselves.
- MikeG1
  Admin
  16 days ago
  Hi H-TS , I can confirm that accessing our software via the browser does save/pre-fill the email address. We're unable to make it optional or allow variation to the time as it is a mandatory ATO requirement.
  **EDIT 21/11 - I am pleased to confirm that email is also remembered for Desktop
  - H-TS
    Trusted User
    16 days ago
    Except the browser version is rubbish and the desktop version used to be brilliant. It's not anymore, but it's still a lot better than the not-fully-functional browser version. Why can't the desktop version remember my email address too? All that ATO stuff reads more to me like the software developers need that level for their developers, not for their users. But then, I rarely understand anything the ATO puts out these days, or I often find two pages on their website that seem to contradict each other. Maybe it's time I considered a career change. I have MYOB open all day, but am not "in it" all day, even if I'm still at my desk doing other things. Is this 30 minutes of inactivity on the computer, or in MYOB?
built4purpose
16 days ago
Not at all happy with this, how do we opt out, I have MYOB open all day, answer phone queries from customers, having to log back in is going to make us look inefficient and slow our processes down. Where can we register our dissatisfaction officially so that you understand that these "enhancements" are "disenchantments" to your customers!
JRFisher
Experienced Cover User
11 days ago
Hi MikeG1

Fair to say this isn't a popular decision, it also appears MYOB have rolled over with the ATO and taking no responsibility for this stupid decision.

Save you referring everyone to a page stating the ATO made MYOB do it, do you have a way we can object to the ATO? Like MYOB the ATO seem to have no understanding of how businesses run, so maybe we need to point this out to them, then you can give your customers what they want?

Hope this helps.
TraceyB06
9 days ago
Signed back in after the "Are you still there?" message appeared then tried to produce a GL report. Got an error message saying "No data found" or something like that. So I completely exited MYOB, then logged back in and then it worked. This glitch never occurred before. PLEASE FIX ASAP!
- MickyH75
  Experienced User
  9 days ago
  I just experienced the same problem. I had already run a report but if I tried to click on a transaction it did nothing. Tried running the report again and no data so close and log back in.
ridgeway
Cover User
9 days ago
This is a joke I have had to log back in 4 times this morning and the login keeps freezing and throwing me out completely. Its taking forever, presumably because this is happening to the majority of MYOB users..

My sales staff, have no access to banking, payroll, superannuation etc etc and cannot affect anything that is sent to the ATO, have the same problem.

Why did't you only force this requirement onto only those users (eg admin) that can affect ATO data, and leave lower level users out of the forced 20 min logon?

MYOB have taken the easiest option for them and not considered the consequences on those using their system in trying to run their own business.

In the ATO page you refer to it says:
Note: the DSP OSF is not intended to capture the end user who owns the data and does not perform a functional role in the supply chain, such as a business using software to run their daily operations.

You have completely ignored this ATO objective.
- MikeG1
  Admin
  9 days ago
  Hi ridgeway - we have rolled back the change in AccountRight while we investigate the freezing.
  Also the note you have referenced from the ATO page does not apply to MYOB and our software. We have worked in consultation with the ATO to implement these changes in line with expectations and requirements
  - Jo15
    Experienced Cover User
    9 days ago
    Why are other software companies not doing this 20-30 minute lockout! only MYOB
Zane2
9 days ago
We seem to have the same problem as many other users - We have 8 MYOB files and usually have a majority of them open at once to do invoicing, reconciliations, internal transfers, etc
We have already moved from 1 login daily to 8 separate log in requirements already, why from 1 secure computer?
Now with the automatic log off we will have what minimum 8 up to maybe 50 re-logins a day - what a WASTE of TIME and PRODUCTIVITY

The ATO has NOT mandated this specific action from MYOB at the level they chose
The ATO has no mandatory 2FA or Inactivity requirements for normal accounting functionality. These apply only to the STP and BAS reporting functionality (For online files).

We know MYOB will not listen to users
We have reviewed our requirements and are closing two files we do not use

Another unhappy MYOB customer
- Jo15
  Experienced Cover User
  8 days ago
  Hi Zane,
  We are a multi company group and the same situation you are in! Files open all day, data matching, intercompany purchasing, transferring funds between all companies! Myob are not listening. I have had a look at the ATO website. It states if you are not using the Multi factor security every 24 hours then this lockout inactivity applies. I am happy to do the MFA (Multi Factor Authenication) to log into each entity Myob file at the beginning of each day! I have been doing some research and another software company starting with x... have this or they have a 60 minute lockout if the MFA is not in use.
- MikeG1
  Admin
  8 days ago
  Hi Zane2 , if you have multiple files, make sure that you are switching between them in the software instead of opening multiple instances of the software.
  That way you will not be required to login multiple times.
  
  Also with the inactivity timeout, it is not a full login required (you do not need to enter your email address and there is no 2FA). You'll just have to enter your password to unlock the screen and continue working
  - BOFAccounts
    Contributing Cover User
    8 days ago
    MikeG1I have seen this comment several times regarding switching between files rather than having multiple files open. While I understand what you are saying, I feel you are missing the point of working between multiple companies/trusts/sole traders within the one Group and that you require each of the entities you are working with open at the same time
Zane2
8 days ago
I do require many open at once to reconcile intercompany transactions on my multiple screens
Are you suggesting for efficiency I log out and into the next one each time I wish to use one
Should I also go back to one monitor for efficiency
- Lisa_BBP
  Trusted Cover User
  8 days ago
  MYOB clearly do not understand the reason for having many different company files open at the same time, let me explain, it's called efficiency for inter-company transaction recording, by having to log in every 20-30 minutes this is called lack of efficiency and leads to poor productivity.