Who should check?
Organizations managing interactive login with Employee, Vendor or Partner roles, particularly teams with existing non-2FA users, vendor/partner portals and a mix of direct login and SAML/OIDC single sign-on. Customer Center roles are not covered by this feature.
Published milestones
- September 21, 2026 — feature became availableAdministrators can elect to require 2FA for Employee, Vendor and Partner roles.
- NetSuite 2027.1 — planned default changeOracle plans to enable the feature automatically, with the documented account exceptions and administrator options.
Check your Oracle account notice before scheduling an update.
What to do next
- Ask the security owner to identify active Employee, Vendor and Partner users, role types and actual authentication paths; exclude Customer Center and respect SAML/OIDC precedence.
- Confirm the account upgrade notice and existing compulsory 2FA policies; prepare enrollment, passkey/authenticator and recovery guidance before rollout.
- Test agreed direct-login and SSO flows with representative users, record access exceptions and obtain an explicit security-owner decision on whether to retain the broader setting.
What we’ll review
Request the account-specific 2027.1 upgrade notice, a role-type and sign-in-method inventory, current mandatory 2FA assignments, user enrollment/recovery procedures and the customer security owner. Do not collect passwords, authenticator secrets or recovery codes.
Sources and updates
Oracle documentation
Authentication release notes ↗Oracle document date: 2026-09-21 · Source checked:
NetSuite 2026.2 September minor release ↗Oracle publication/update date not stated on this page. · Source checked:
Oracle 2FA for All Roles: Employee, Vendor and Partner roles, SAML/OIDC and opt-out ↗Oracle publication/update date not stated on this page. · Source checked:
How this change developed
Passkeys and employee-access preparation
- — Capability available
- — Administrator option available
Earlier changes to this product
Explore the full platform archive →Update history
- 2026-10-17 — Added this guide using existing Oracle documentation.
- 2026-11-09 — Material correction to existing October 17 brief: September 21 Oracle release notes and current Help Center explicitly include Vendor and Partner roles as well as Employee roles; clarified SAML/OIDC precedence, Customer Center exclusion and administrator-controlled default. Not a new November Oracle announcement.