Recently MYOB Aust introduced new 2FA and other security measures that are causing quite a stir amongst AR2024 users - according to the MYOB Community Forum.

MYOB announced 'Users will be automatically signed out of their account after 20-30 minutes of inactivity in MYOB products'.

After a period of inactivity, the software is meant allow the user back in by re-entering their password, yet many are finding they are forced through 2FA each time as well. In time hopefully MYOB will sort this out.

Users are demanding changes, or to make the new measures optional where the user thinks it might be required etc. Standard response from Moderators is that these changes are 'mandated by the ATO'.

Well - as a matter of fact, they are not mandated by the ATO - at least not in the way MYOB is suggesting. Nor did the ATO mandate that your company file had to be online to use STP Phase 2 - this was purely a MYOB decision.

The ATO does mandate 2FA and Inactivity limits where data subject to STP Reporting is hosted online. Users will recall STP Reporting Phase 1 - how when wanting to complete Payroll and STP Reporting, users would be promted to sign in to MYOB Payroll Reporting Centre. It is this functionality and this only what would require 2FA and inactivity limits.

Predominantly AR2024 is an accounting system. Most businesses use it for generating invoices, managing payments etc, as well as payroll. An inactivity limit on the payroll process sounds fair enough, after all this is performed once a week or fortnight, and usually done in one session.

Other accounting functions such as invoicing however is usually (and hopefully) an all day process, it is common to have the software open all day and for frequent periods of in-activity. The ATO has no mandatory 2FA or Inactivity requirements for normal accounting functionality. These apply only to the STP and BAS reporting functionality.

This is where AR2024 users are now caught. MYOB Aust took the decision to force all files online for STP Reporting Phase 2. So now the entirety of the software functions are subject to the 2FA and Inactivity limits as mandated by the ATO for STP Reporting software.

To us it seems a little 'rich' for MYOB moderators to now blame the ATO for these new measures. Remember it was MYOB who decided to force all files online.

For those adversely affected by this change, it might be time to seriously consider this question: Do you really need to keep your file online?

In the past many businesses coped just fine using their file offline running the Server Edition. The strongest reason for having the file online is when it needs to be accessed by staff etc in multiple physical locations. If this is the case, then you will likely need to simply adapt to the new security requirements and the 'less than perfect' implementation by MYOB developers.

Or have your own IT set up remote access for offsite users.

While having the file online does have its advantages, the reason many are online is only because they were forced to by MYOB to comply with STP Reporting - Phase 2.

If you are online simply because of STP Reporting, we thought we'd point out there is an alternative - see STP Creator - developed specifically for MYOB offline files including AR2024 files.



FYI - complaining to moderators on their forum will not change anything. If you want MYOB to change, you need to go 'outside', see here for a suggestion.