Passkeys Can Now Replace Authenticator Apps for 2FA (2026.2)

What changed

Passkeys (biometric or hardware FIDO2 tokens) were already supported as a password alternative at the login screen. In 2026.2, their scope expands: a FIDO2-compliant passkey can now satisfy the two-factor authentication (2FA) prompt, eliminating the need to open an authenticator app and type a TOTP code on every login.

Conditions for passkey-based 2FA

• The passkey must be FIDO2-compliant. Non-certified keys are explicitly discouraged by Oracle for security reasons.
• The administrator must not have disabled the new Passkey as 2FA feature flag. Disabling it reverts 2FA behavior to the previous authenticator-app-only flow.
• The user must be in a login flow that would normally require a 2FA code.

Periodic authenticator-app fallback

Even when passkey-based 2FA is active, NetSuite will prompt for a traditional authenticator-app code once every three months. Oracle states this is to verify the authenticator setup still works and remains available for 2FA-reset scenarios. This means users and admins cannot decommission their authenticator-app enrollment.

Passkey management

Users manage passkeys from the Settings portlet → Manage Passkeys page on the Home dashboard. From there they can create, rename, or delete passkeys. No Admin-level record or SuiteScript API for passkey management is documented.

What the source does not clarify

• Whether the Passkey as 2FA toggle is a company-wide preference, a per-role setting, or a per-user option. Admins should check Setup → Company → Enable Features (or the equivalent Authentication section) after 2026.2 lands in their account.
• Whether any SuiteScript, REST, or SOAP API surfaces are affected. The release note is entirely UI-focused; there is no mention of programmatic passkey provisioning or 2FA-mode query endpoints.
• Whether WebServices/SuiteTalk token-based or OAuth 2.0 flows are impacted. Based on the language ("login process," "log in to NetSuite"), this appears limited to interactive browser sessions.

What to do

1. Admins: After 2026.2 reaches your account, decide whether to allow passkey-based 2FA. Look for the Passkey as 2FA feature toggle. If your security policy requires authenticator-app codes on every login, disable this feature.
2. Admins: Update internal authentication documentation and onboarding guides to reflect that passkeys can now satisfy 2FA, and that authenticator apps are still required (quarterly prompt).
3. Users: If you choose to use a passkey for 2FA, ensure it is FIDO2-certified. Check the FIDO Alliance's certified-products list if unsure. Non-certified passkeys are flagged by Oracle as a potential security risk.
4. Users: Do not uninstall or lose access to your authenticator app. NetSuite will still ask for an authenticator code every 90 days and during any 2FA-reset flow.
5. Integration developers: No action required at this time. The feature appears limited to interactive UI login and does not surface in documented APIs. Monitor future SuiteScript or REST API release notes for programmatic passkey management.