When the Require 2FA For All Employees feature becomes available and enabled by default in Release 2027.1, If we want to NOT require everyone to start using 2FA, then do we only need to disable that feature right after the Release lands? Is there anything else we'll need to do?

that was the impression I got from the message as well.

Put NetSuite behind a SSO, let that manage your users and your MFA. Only Administrators then need to have the OTP/Passkey this way. Much easier way for you to administer your environment. The SSO should satisfy the MFA requirements for you standard staff and your IT Teams will find this as less administration overall.

is it confirmed this change won't affect users who login using SAML authentication then? I was going to ask my account manager, but won't bother her if there's some other documentation knocking around

It shouldn't. OIDC is also unaffected

is it confirmed this change won't affect users who login using SAML authentication then? I was going to ask my account manager, but won't bother her if there's some other documentation knocking around

This is already working today. You might have roles with mandatory 2FA due to high level permissions. If you put the elevated roles behind SAML, NetSuite will consider that the compliance is now handled outside and not enforce any 2FA

And the "Administrator" Role is recommended not to be SSO. It can't' be for SAML, but I did find that you can allow it for OIDC. Not recommended

I am curious, how will this affect users who can not use SAML due to restrictions on the handheld scanners in our warehouse

@Brad Hosking That's how we're already running things: All roles except Admins sign in to NetSuite using SSO. That's why we want to disable requiring MFA for all users when it becomes the new default.

I have require MFA on all my roles as a requirement. You don't need to disable this as I also use SSO and this satisfies the MFA requirement. So you do not need to disable this in fact in your sandbox test this out. It’s actually extra precaution because with OIDC login (not SAML) the role can be both logged into (username/password) and also SSO via OIDC. SAML on the other hand is different and seems to lock it down more but that MFA requirement can still be put in there and it won't affect it. If you use Entra as your SSO you'll need to us OIDC because you can't have two Entra SAML apps (prod/sandbox) with the same identifier. You'll need to make that login OIDC

If you use Entra as your SSO you'll need to us OIDC because you can't have two Entra SAML apps (prod/sandbox) with the same identifier. You'll need to make that login OIDC

You can nowadays. You can leave the account specification in azure as null so then you can switch between accounts. The official documentation is a bit outdated on that. If you add a value, then it is locked to that specific environment. I have configured many account to use SAML across multiple SBs and Prod.