Fix NetSuite Multiple Sessions Not Working After 2026

After the February 2026 release, enabling the relevant account feature at Setup > Company > Enable Features > Company > Access should let the same credentials stay active across browsers or devices. In practice, many accounts still force the first session out the moment a second login succeeds. The culprit is usually a role-level 2FA requirement or a user who holds at least one non-2FA-protected role.

The Feature Flag Is Only Half the Story

The relevant account feature checkbox unlocks the capability at the account level. It does not guarantee every user inherits it. As of 2026.1, the feature is only available to users who have only 2FA-protected roles. If any of your roles in the account aren't 2FA-protected, you can only use one NetSuite session, regardless of the account setting.

The user's role composition overrides the account setting. Always verify that every role assigned to the user is designated as a 2FA-required role.

Step-by-Step: Enable the Account Feature

1. Go to Setup > Company > Enable Features.
2. Click the Company tab.
3. Scroll down to the Access section.
4. Check the relevant account feature.
5. Click Save.

Step-by-Step: Verify Role Configuration

1. Open Setup > Users/Roles > Manage Roles.
2. Edit each role assigned to the test user.
3. Check the Two-Factor Authentication Required field. There's no "Required" value to pick. The field asks for the type of authentication the role requires, so select one for every role that should be 2FA-protected.
4. Repeat for every role the user holds, even custom roles.

If you'd rather review every role at once, an administrator (or a user with the Two-Factor Authentication base permission) can mark 2FA-required roles on the Two-Factor Authentication Roles page. Customer Center roles can't take the designation.

Log out completely, then log in from Browser A. Open Browser B (or an incognito window) and sign in with the same credentials. Both sessions should remain active, up to the three-session limit.

Two-Factor Authentication Is Now a Prerequisite, Not a Blocker

NetSuite 2026.1 changed the model: 2FA is no longer an obstacle to multi-session, it's a requirement. When a role is designated as 2FA-required, each new device must complete the 2FA challenge. If the second device fails or times out on the challenge, NetSuite treats it as a failed login. The existing session remains valid; the new one simply isn't created.

Workaround for testing: temporarily assign the user only roles that are 2FA-required, confirm multi-session works, then adjust role assignments as needed. For production, ensure every device has a registered authenticator app, SMS number, or passkey before relying on concurrent sessions.

Account-Level Security Policies That Interfere

Navigate to Setup > Company > Preferences > General Preferences and check this field:

Also look for roles with the SAML Single Sign-on permission. Oracle's docs say that adding SAML SSO to a role already designated 2FA-required makes NetSuite ignore the 2FA requirement, because the SAML permission takes precedence. That role stops counting as 2FA-protected, so a user who holds it drops back to a single session even with the feature enabled.

There is no legacy Enforce Single Session Per User preference in General Preferences that overrides the new feature. The controlling logic lives in the Enable Features flag and the user's role composition.

Browser and Network Gotchas

• Shared cookie jar: Two tabs in the same browser profile share cookies, and NetSuite syncs session state across tabs of the same account. Use different browsers (Chrome + Firefox) or incognito/private windows for true isolation.
• Role switching: Changing roles invalidates the sessions from the previous role and locks those tabs. A tester who switches roles mid-test will read that as the multi-session feature failing.
• SSO logins: A user who signs in through SAML lands on a role where the 2FA requirement is ignored (see above). Test with a user whose roles carry no SAML SSO permission to rule this out.

Quick Validation Checklist

• [ ] Account feature the relevant account feature = Enabled
• [ ] Every role assigned to the user has an authentication type in Two-Factor Authentication Required
• [ ] User holds no non-2FA-protected roles
• [ ] None of the user's roles carries the SAML Single Sign-on permission
• [ ] Tested with distinct browser profiles or devices

If every box is ticked and the first session still drops, review the user's recent logins in the Login Audit Trail (Setup > Users/Roles > User Management > View Login Audit Trail). Then open a case with NetSuite Support and include the roles you audited.

Once the account flag is set and every role is 2FA-required, the feature works as documented. If you hit a wall, run a manual role audit before you open a support ticket.