Changes to Multi-factor Authentication and Mobile Device Registration

Coming in January 2026, multi-factor authentication (MFA) will be required for the majority of web app users. MFA is already enforced for users with permission to manage roles or users; this requirement will then be extended to other web app user roles.

The exception to this requirement will be for web app users that only have permissions related to Returns and/or Despatch. This is intended to ensure that returns and pack bench workstations can continue to operate seamlessly.

Multi-factor authentication codes will not be required for mobile operators, but from January 2026, any new mobile devices accessing the system will first need to be registered via a new web app page coming soon. The intent behind this change is to ensure that only authorized devices are permitted to connect to the system, and to provide administrators with greater control over onboarding and offboarding mobile operators.

This device registration page will also support a number of other functional enhancements, such as assistance to find lost devices, and login audit history.

We will be communicating these changes separately in an upcoming announcement as well.

You can find more infomration about future releases here