The myth: "I'll just send you my Xero login"
It happens most weeks. A client in Hoppers Crossing or Altona emails us their Xero email address and password so we can "jump in and have a look" before the 31 October lodgment deadline. The intention is good — they want to make things easy. But sharing your login is unnecessary, and it creates real problems.
The accurate position: Xero is built for multiple users. You invite your accountant as a separate user with their own credentials, under their own name, with a permission level you choose — and you can revoke that access at any time with two clicks. This is what's known as Xero invite access, and it takes about ninety seconds to set up.
Why the myth persists
Three reasons, mostly:
- Habit from the desktop era. Business owners who came from MYOB or a shoebox of receipts are used to handing over a file, a backup, or a shared computer. Cloud accounting works differently, but the mental model lags behind.
- Assuming extra users cost extra. Xero's pricing is per organisation, not per user. Adding your accountant, your bookkeeper and your business partner doesn't change your subscription price.
- Not knowing where the setting lives. The invite screen sits under Settings, not somewhere obvious on the dashboard, so people assume it's an admin task only Xero can do.
Why sharing your password is a genuinely bad idea
This isn't just tidiness. There are four practical problems:
- Xero's own terms. Xero requires each user to have their own account and prohibits sharing login credentials. Sharing a password can put you offside with the terms you agreed to.
- Two-factor authentication breaks it anyway. Xero mandates 2FA on every login. If your accountant tries to sign in as you, the authentication code goes to your phone or authenticator app — so you end up reading six-digit codes down the phone every time. It's slower than just doing it properly.
- You lose the audit trail. Xero's History & Notes records who changed what and when. If everyone logs in as you, every change looks like it was made by you. When there's a question about who reconciled a transaction or altered a BAS figure, you've destroyed the evidence.
- Offboarding becomes a nightmare. Change accountants, or have a bookkeeper leave, and you now need to change your password and reconfigure your own access. With proper user roles, you just remove the user.
How to grant Xero invite access, step by step
You'll need to be an Adviser or Subscriber-level user on the file to add others. Then:
- Click your organisation name in the top left, then Settings.
- Under Users, select Users, then Invite a user.
- Enter your accountant's first name, last name and email address. Use the exact email address they give you — an invite sent to the wrong address means they simply never receive it.
- Choose the user role and permissions (see below).
- Click Send invite.
Your accountant receives an email invitation and accepts it using their own Xero credentials. The invite is time-limited, so if a few weeks pass without action it may expire — you can simply resend it from the same Users screen.
Which role should you give your accountant?
This is where most people get stuck. Xero's roles are layered, and giving too little access is as unhelpful as giving too much.
- Adviser — the standard level for an accounting or bookkeeping practice. It allows access to the full chart of accounts, manual journals, and the reporting your accountant needs to prepare financials and tax returns.
- Payroll admin — tick this separately if you want us handling STP filing, payroll reconciliations or superannuation. Payroll permissions are controlled independently of the main user role.
- Reports access — make sure your accountant can see all reports, not a restricted subset, or you'll get emails asking you to run and export things yourself.
What your accountant generally does not need is Subscriber status. The subscriber is the person who owns and pays for the Xero subscription — that should usually stay with you, the business owner. Handing over the subscription isn't required for us to do the work, and keeping it means you always control the file.
A note on Xero Practice Manager and the Xero to Xero connection
Some practices ask to be added with an "Adviser" role so the file appears in their practice dashboard. That's normal and it's the same invite process — you're still the one issuing the invitation, and you can still remove access later.
Access is not the same as authority to deal with the ATO
This is the follow-on misconception, and it matters more than the first one. Giving us Xero invite access does not make us your tax agent. They're two entirely separate things:
- Xero access is granted by you, inside Xero, and lets us see your accounting data.
- Tax agent appointment is done through the ATO's Online services for agents. Under the ATO's client-to-agent linking rules, most entities with an ABN — companies, trusts, partnerships and others — must nominate their agent themselves in ATO Online services for business using their myGovID (now myID) and Relationship Authorisation Manager access, before the agent can add them.
The nomination has a limited validity window, so it needs to be done reasonably close to when your agent adds you. If you nominate and then don't tell us, it can lapse and you'll need to do it again. Individuals and sole traders are generally handled differently, but for company and trust clients this step catches people out constantly — particularly in September, when everyone is trying to get organised before 31 October.
Getting your file ready before you send the invite
If the goal is a fast, low-cost job, a little preparation before you hit send makes a real difference:
- Reconcile your bank feeds up to 30 June, or at least tell us where you've stopped.
- Clear the suspense account. Transactions parked in "Suspense" or coded to a catch-all are the single biggest source of back-and-forth emails.
- Check your bank feeds are still connected. Feeds drop out when banks change security requirements, and a missing month of transactions won't announce itself.
- Attach source documents. Xero lets you attach a PDF invoice or receipt to the transaction. Under Australian record-keeping rules you generally need to keep records for five years, and having them in the file rather than a drawer makes that painless.
- Flag anything unusual — an asset purchase, a new loan, a director drawing, a property settlement. Tell us in a note rather than hoping we spot it.
How to remove access later
Same screen. Settings, Users, click the user, then Remove user. Their access ends immediately. Historical entries they made stay in the file with their name against them, which is exactly what you want — the audit trail survives even though the access doesn't.
It's worth reviewing your Xero user list once a year, ideally at the same time you do your end-of-year housekeeping. Former bookkeepers, a business partner who's exited, a staff member who left in 2022 — they're often still sitting there with full access because nobody thought to check.
The bottom line
Sharing your Xero password feels helpful, but it's slower, riskier and against Xero's terms. Proper Xero invite access takes ninety seconds, costs nothing extra, preserves your audit trail and leaves you in control of the file.
If you're a small business in Werribee, Tarneit, Point Cook, Williamstown, Sunshine or anywhere across Melbourne's west and you're not sure whether we have the right level of access to your file — or whether your tax agent nomination is still current with the ATO — get in touch with ProPartners Accountants & Advisers before the 31 October deadline. It's a five-minute conversation that saves a lot of scrambling in late October.