The short answer
HMRC agent multi-factor authentication explained for 2026/27: the final activation window, access-code settings, staff accounts and an administrator checklist.
HMRC is introducing multi-factor authentication (MFA) across agent accounts to add an extra security step when agents sign in to online services. If your firm has not already had MFA activated, HMRC says the remaining accounts will be activated during the final window from 28 September 2026 to 15 October 2026.
HMRC cannot give an individual firm a specific activation date. Accounts are activated around 9am on Monday to Thursday during the window. The practical question for a tax practice is therefore not whether MFA is coming, but whether the right people can receive access codes when it is switched on.
Activation is imminent
Check code settings now
Use individual staff accounts
What HMRC’s agent MFA change means
MFA requires an additional access code or security step after the usual sign-in details. It is intended to protect agents and their clients if a password is compromised. HMRC says the change brings agent accounts in line with the protection already used for individual and organisation Government Gateway accounts.
The change applies to the relevant agent accounts, including accounts connected with an agent services account or HMRC online services for agents. It is an account-security change, not a new tax charge, filing deadline or client authorisation rule.
The final activation window
| HMRC position | What to expect |
|---|---|
| MFA already activated | Continue using MFA and review the settings if contact details have changed |
| Early activation selected or completed | The selected activation date may already have passed; keep the account settings current |
| No MFA yet | HMRC says the account will be included in the final window from 28 September to 15 October 2026 |
| Exact activation date | HMRC cannot provide a specific date; activation is around 9am Monday to Thursday during the window |
If your firm has several agent identifiers or accounts, do not assume that checking one sign-in proves every account is ready. Review each relevant account and the staff who use it.
How to prepare an agent services account
HMRC’s Tax Agent’s Handbook gives the following route for an agent services account:
- Sign in to the agent services account.
- Select Manage account.
- Choose Manage your own sign-in details.
- Select How you get access codes.
- Review the existing security preferences and update or add an access-code method.
An MFA option may already exist because someone in the firm enabled it while using another HMRC service, such as Making Tax Digital for VAT. Do not assume that an old phone number, email address or authenticator setup is still accessible. Check the details with the person who will actually need to sign in.
For an HMRC online services for agents account, HMRC’s route is to select the account from the home screen, choose Change details or Change password, enter the Government Gateway profile if the security console appears, and then select How you get access codes.
Staff and administrator checklist
The safest preparation is a short account review before the activation window:
- list every administrator and staff member who signs in to HMRC services;
- confirm that each person has an individual Government Gateway user ID where HMRC requires one;
- check that each person can access their selected MFA method;
- add a backup option where HMRC allows it;
- remove or replace obsolete phone numbers and contact details;
- review administrator roles and remove access that is no longer needed;
- test the sign-in process before a filing or client deadline; and
- keep a secure internal record of who owns each account, without recording passwords or access codes.
Administrators can remove MFA options for team members, but HMRC says they cannot set up new options for other people. Each user should therefore complete the part of the setup that belongs to their own sign-in.
- 1Map the firm’s HMRC access — Identify agent services accounts, HMRC agent accounts, administrators and staff users. Include accounts used for different agent identifiers.
- 2Review each user’s access-code method — Check the method and contact details in the account’s security settings. Replace anything that depends on a former employee, old device or shared mailbox.
- 3Check permissions and roles — Confirm that administrators and staff have the access they need, while former staff and unnecessary permissions are removed through the firm’s normal access-control process.
- 4Plan around the activation window — Do not schedule a critical client filing or account change on the assumption that HMRC will activate MFA on a known date. Allow time for a sign-in or recovery issue.
What if a user cannot sign in after activation?
First check whether the access code is being sent to the method currently saved in the user’s MFA settings. If the user no longer has access to that method, use HMRC’s current account recovery or sign-in support route rather than asking another person to share credentials.
Keep client deadlines separate from the MFA rollout. A sign-in problem does not extend a tax filing or payment deadline. If access is time-critical, check HMRC’s service availability notices and contact the relevant HMRC agent support route.
Make the firm ready without sharing secrets
Create an access map rather than a password spreadsheet. Record the account or agent identifier, the responsible administrator, the staff role and the approved recovery route. Do not record one-time codes, passwords or authenticator seeds in the map. Store the document in the firm's controlled access system and review it when staff join, leave or change role.
An administrator should confirm that leavers have been removed through the firm's normal access process and that a remaining authorised person can manage the account. A shared mailbox or shared phone can create a single point of failure, but moving everyone to an unapproved shared method can also weaken accountability. Follow HMRC's supported settings and the firm's security policy for each individual user.
Test the real filing journey
A successful sign-in test is not the same as a complete readiness test. Before a busy filing period, test the relevant agent service with a user who is authorised for that service, confirm that the code arrives through the saved method and verify that the staff member can reach the client-management screen needed for their role. Do not submit or change client data merely for testing.
Record the test date, account used, result and any action required. If a user relies on a new phone or authenticator, test the new device before disabling the old method where HMRC's settings allow both to be available. Keep a short contingency plan for who can deal with a filing if the primary user cannot sign in, while preserving individual authentication.
Activation window and operational continuity
The stated activation window is not a booking slot. HMRC does not give each firm a guaranteed activation date, so the practice should treat every day in the window as a possible change day. Avoid leaving an urgent client submission, payment or authorisation until the final day. Where a deadline cannot be moved, complete the work early and retain the submission receipt.
If activation occurs while staff are working, stop and verify the account settings rather than repeatedly entering an old code. Check the account identity, device, time settings and saved contact method. Repeated failed attempts can create a separate support problem. Never ask a colleague to forward an access code; the code is part of that user's authentication.
Recovery, phishing and support
Treat an unexpected MFA message, code request or sign-in prompt as a security event until verified. HMRC will not need a colleague's one-time code to restore another user's access. Use the official GOV.UK route reached from the relevant account or Tax Agent's Handbook, and do not follow an unverified link in an email or message.
When contacting support, record the account identifier, affected user, time of failure and the steps already tried, but do not disclose passwords or codes. If a device is lost, report it under the firm's security policy, remove the old method through the supported account controls when possible, and document the recovery. The recovery process may take time and does not alter the legal filing deadline.
Review after the rollout
After the activation window, repeat the account inventory. Check that each active user has a working method, each former user is removed, backup arrangements are documented and no obsolete phone number or shared mailbox remains. Compare the firm's access map with the users shown in the HMRC account, and archive evidence of the review.
MFA should be treated as one layer of access control. Continue using individual permissions, least-privilege roles, secure devices, software updates and client-data controls. Do not describe successful MFA activation as proof that the agent is authorised for every HMRC service or that the firm's tax adviser registration requirements are satisfied.
The review should also identify services that are used rarely, such as a specialist tax head or an old agent identifier. Test those accounts separately if they remain active. If the firm no longer needs an identifier, follow HMRC's account-closure or access-removal process rather than leaving an unowned account in the inventory. Keep the review date and owner visible so the next activation or staff change has a clear starting point. Update the inventory after every recovery event.
Record the action owner and completion date for each account.
Review unresolved items weekly.
Close the item only after verification.
Separating MFA from Other HMRC Obligations
MFA readiness answers only the question of whether an authorised user can sign in securely. It does not confirm that the firm has the right agent identifier, that a client authorisation is current, or that a particular tax service is available to that user. Review those items separately. A practice can have a working code and still need to correct an administrator role, renew an authorisation or use a different HMRC service for a client task.
Where one practice operates several offices or agent identifiers, create one inventory with an owner for each account rather than assuming the main administrator covers every service. Note which staff member can perform each critical action, which recovery route applies and when the last test succeeded. Do not make a shared phone or inbox the only fallback. Individual authentication protects the audit trail and makes leaver removal possible.
If the firm changes practice-management software, devices or staff at the same time as MFA activation, keep the changes separate in the incident log. First establish whether the failure is sign-in, permission, software connection or client authorisation. Capture the exact error and time, then use the official HMRC support route. This avoids repeatedly changing security settings when the underlying issue is a service permission or an outdated integration.
Frequently Asked Questions
When will HMRC activate MFA for agent accounts?
Does HMRC MFA change my clients’ tax deadlines?
Can an administrator set up MFA for every employee?
Should staff share one phone or Government Gateway login?
How do I check or change the MFA access-code method for an HMRC agent account?
What if a user no longer has access to the phone or device used for HMRC MFA?
Does checking one HMRC agent account prepare the whole firm for MFA?
Is MFA the same as tax adviser registration?
Use HMRC’s Tax Agent’s Handbook for the live account steps and check Agent Update 147 for rollout notices. For the separate registration requirement, see the HMRC tax adviser registration guide and HMRC’s agent services account application guidance.
Official sources
Related Guides
HMRC Tax Adviser Registration 2026/27 — Who Must Register and When
HMRC tax adviser registration explained for 2026/27: who needs an agent services account, phased windows, exemptions, overseas advisers and sanctions.
UK Alcohol Duty Returns 2026/27 — Deadlines and Penalties
Alcohol Duty monthly return deadlines, nil returns, payment timing and the announced points-based penalty reform for UK approved producers.
Amended Company Tax Returns Online from April 2027 — UK Guide
UK Corporation Tax amendment filing changes planned for 1 April 2027: online filing, proposed exceptions, existing 12-month rights and preparation steps.
Review notes and assumptions
Reviewed
2026-09-20
Assumptions
- This guide covers HMRC sign-in preparation for agent accounts; it does not replace HMRC's live account instructions or explain client tax calculations.
- The final automatic activation window is based on HMRC guidance available on 20 September 2026 and may change if HMRC updates the service.
- MFA settings are personal to the sign-in user and should not be shared across staff or treated as a substitute for individual Government Gateway accounts.