Where do I go in NetSuite to look at whether we are using HMAC-SHA256 signature method for TBA instead of HMAC-SHA1 signature method for TBA (Token Based Authentication). See page 8 in these release notes for the announcement about it.

It's not in NetSuite. It's being used by the external application. You will need to check your external integrated apps.

I actually found a setting that is related. Setup > Company > Enable Features > SuiteCloud tab > Manage Authentication section. See the field "Disable HMAC-SHA1 for Token-Based Authentication". But @NickSuite thank you for this pointer. I'll check our other integrations and look at their TBA method.

You can use that toggle to see if any of your external apps fail (since they're still using SHA1). But this has been 'imminent' for 3 years now, your partners should have them current.

You can also look at your SOAP Web Services logs and inspect the xml to see what signature is being used, though that's pretty painful. I like your way better