Two-Factor Authentication for All Roles and SuiteAnalytics Connect
On October 20, 2026, NetSuite notified SuiteAnalytics Connect customers about the expansion of two-factor authentication (2FA) requirements in NetSuite 2027.1
The Require 2FA for All Roles feature requires users with the Employee, Vendor, or Partner entity to use 2FA in all their assigned roles. The feature doesn't include the Customer Center role.
Require 2FA for All Roles is available now, disabled by default. You can enable the feature to test how the change will affect your account in NetSuite 2027.1. Before enabling the feature in your production account, you should test it in a sandbox or Release Preview account.
In NetSuite 2027.1, Require 2FA for All Roles will be enabled automatically.
Impact on SuiteAnalytics Connect
If you have SuiteAnalytics Connect connections, the Require 2FA for All Roles feature affects which authentication methods your connections can use.
A SuiteAnalytics Connect connection that uses NetSuite account email address and password for authentication stops working when the associated role requires 2FA. This applies to ODBC, JDBC, and ADO.NET connections. Even after you complete 2FA setup for accessing NetSuite, Connect connections that use login/password authentication cannot connect with a role that requires 2FA.
OAuth 2.0 is the preferred authentication method for Connect. It allows connections to use eligible roles that require 2FA. See OAuth 2.0 for Connect and Authentication for SuiteAnalytics Connect.
You must configure OAuth 2.0 in both NetSuite and your client application. Enabling OAuth 2.0 in your account doesn't automatically update existing connections. If you use a third-party application, contact your provider for configuration instructions.
Alternatively, a user with the Administrator role can disable the Require 2FA for All Roles feature to retain existing connections that use NetSuite account email address and password for authentication. For information about how to enable and disable NetSuite features, see Enabling Features.
Disabling the Require 2FA for All Roles feature restores previous role-specific 2FA requirements and reduces account-wide 2FA protection. Roles that still require 2FA cannot use NetSuite account email address and password authentication for Connect.
If you choose to disable the Require 2FA for All Roles feature, verify the feature setting and your connections when your account is upgraded to NetSuite 2027.1.
Test your chosen approach in a sandbox or Release Preview account before updating your production account. Complete testing before your account is upgraded to NetSuite 2027.1. For general information about the feature, see 2FA for All Roles.