NetSuite Passkeys Can Now Replace Your Authenticator App: What Changed in 2026.2
Need help with this in your NetSuite account?
A passkey is a FIDO2-based credential that authenticates a user using biometrics or a device PIN instead of a password, eliminating the need to remember or type credentials. In NetSuite, passkeys enable passwordless login but were not previously recognized as a sufficient second authentication factor on their own.
If you use a passkey to log into NetSuite, you may have noticed that even after setting one up, the system still prompts you for an authenticator app code on some logins. That prompt existed because passkeys, up until 2026.2, handled passwordless authentication but were not recognized as a second authentication factor on their own.
NetSuite 2026.2 changes this.
Quick answer
NetSuite 2026.2 allows users with a FIDO2-compliant passkey to use it as a second authentication factor, not just for passwordless login. If your account requires two-factor authentication and you have a passkey set up using Face ID, Touch ID, Windows Hello, or a FIDO2-certified hardware security key, that passkey can now satisfy the 2FA requirement without requiring an authenticator app code. The feature works automatically once a qualifying passkey is configured in the user's account. A 3-month fallback remains: even with a passkey as the second factor, NetSuite prompts for an authenticator app code every three months as a built-in security check, so keep the authenticator app installed. Administrators can disable the passkey-as-2FA feature at the account level. This change is separate from the passwordless login feature also added in 2026.2, which uses the passkey to replace both the password and 2FA prompt entirely.
What Changed for NetSuite Passkey Second Factors in 2026.2?
Users who have a FIDO2-compliant passkey configured in their NetSuite account can now use that passkey as a second factor, not just as a passwordless login method.
If your account requires two-factor authentication, your passkey can satisfy that requirement. You no longer need to open an authenticator app and enter a code every time.
What Does FIDO2-Compliant Mean for NetSuite Passkeys?
FIDO2 is the technical standard that modern passkeys are built on. Your passkey qualifies if you created it using:
- Face ID or Touch ID on an iPhone, iPad, or Mac
- Windows Hello on a Windows device with a fingerprint reader or face recognition camera
- A FIDO2-certified hardware security key
Passkeys created through these methods are FIDO2-compliant and work as a second factor in NetSuite.
What Is the 3-Month Authenticator Prompt After Enabling a Passkey?
Even with a passkey configured as your second factor, NetSuite will still prompt you for an authenticator app code every three months. This is a built-in fallback, not a sign that something is misconfigured. Keep your authenticator app installed and your backup codes stored somewhere safe.
What Do Administrators Need to Know About Passkey Second Factors?
Administrators can disable the passkey-as-2FA feature for their account. If your organization has compliance requirements around which second-factor methods are approved, or if you want to control the rollout, you can disable this in your account's authentication settings and users will revert to the standard authenticator app prompt for 2FA.
How Is Second-Factor Passkey Different From Passwordless Login?
In 2026.2, NetSuite released two separate passkey-related changes:
Passwordless Authentication with Passkeys: Use your passkey to sign in without a password at all. This replaces the password and 2FA prompt entirely.
Passkey as a 2FA Authenticator: Use your passkey as the second factor when you are still logging in with a password.
These are two separate use cases. If you are already using passkeys for full passwordless login, the 2FA change may not affect your day-to-day experience. But if your account uses password plus 2FA and you want to remove the authenticator app step, this is how.
What Should You Do About the Passkey Second Factor Change?
If you want to use your passkey as a second factor in NetSuite, you do not need to do anything extra. The change works automatically once you have a FIDO2-compliant passkey set up in your account. If you have not set one up yet, see How to Enable Passkeys in NetSuite for the setup steps.
If you are a NetSuite administrator and want to control whether this feature is available to your users, check your account's authentication settings in NetSuite Setup.
Frequently asked questions
Q: Can a passkey be used as both the first and second factor in the same login? A: NetSuite 2026.2 has two separate passkey features that cover different scenarios. Passwordless login uses the passkey in place of both password and 2FA. The passkey-as-2FA feature applies when users log in with a password and need a second factor. These are separate configurations.
Q: Do all users automatically get this capability after 2026.2? A: Users need a FIDO2-compliant passkey already configured in their account. If a passkey was set up using Face ID, Touch ID, or Windows Hello, it will work as a second factor automatically once the account is on 2026.2 and the feature is enabled.
Q: What if a user's passkey stops working or is on a lost device? A: The 3-month authenticator app fallback means users with passkeys still need their authenticator app available as a backup. Keep it installed and maintain access to backup codes so there is always a fallback path into the account.
Q: Can administrators disable this feature for specific users rather than the entire account? A: The administrator control for this feature is at the account level, not the individual user level. Disabling it reverts all users to the standard authenticator app prompt for 2FA.
Q: Does this change affect the 2FA requirement for administrator accounts? A: Administrator accounts are still subject to 2FA requirements. A FIDO2-compliant passkey can satisfy the 2FA requirement for an administrator account when the feature is enabled at the account level.
NetSuite authentication configuration for your user base is covered under SuitePacific's NetSuite administrator support.
More From the Blog
How to Switch from NetSuite ACS to a Managed Support Firm
Already decided to leave ACS? This guide covers the transition: auditing your current contract, documenting your account, timing the handoff, finding a replacement, and what to expect in the first 30 days with a managed support firm.
NetSuite ACS Tiers Explained: What Advise, Monitor, Optimize, and Architect Actually Cover
A tier-by-tier breakdown of NetSuite Advanced Customer Support: what each ACS tier includes in practice, what none of them cover, who each tier is designed for, and when upgrading a tier solves a problem versus when the issue is ACS scope.
Have a NetSuite challenge like this?
We work with post-go-live NetSuite accounts every day. Tell us what you're working on.