NetSuite 2026.2 Release Notes: System Administrators

This is the third installment of our NetSuite 2026.2 Release Notes Series, broken down by role so you only read what applies to your work.

For administrators, 2026.2 is mostly about access: how people log in, what a new override layer can silently take control of, and which authentication methods have a countdown on them.

A note on sourcing. This is based on Oracle's Release Preview release notes for 2026.2, which every page marks as subject to change. Details can shift before general availability, and we will update this post if Oracle revises them.

---

Passkeys: passwordless login is live

As of July 13, 2026, all NetSuite users can set up passwordless authentication with a passkey and use it instead of a password at login.

Two boundaries worth communicating clearly before your help desk hears about it:

• Passkeys work for logging in only. Users still need a password for other actions inside NetSuite. Nobody gets to forget their password entirely.
• A FIDO2-compliant passkey can also serve as the second factor during login, as of 2026.2. Administrators can disable this, which forces users with FIDO2 passkeys back to an authenticator app for 2FA.

There is a detail in Oracle's notes that will generate tickets if you do not pre-empt it: NetSuite prompts users for an authenticator app code every three months regardless, to confirm they still have a working 2FA setup for cases where the passkey is unavailable. Users who set up a passkey and delete their authenticator app will be locked out at the three-month mark. Tell them to keep it.

Practically: passkeys are a genuine phishing-resistance win, and rolling them out to finance and admin roles first is a reasonable prioritisation. Just document the password-still-required and quarterly-code behaviours in the same message you use to announce it.

---

The 2027.1 authentication deadlines

Three deprecations were announced in 2026.2 and all take effect in 2027.1 — one release away. None of them break anything now, which is exactly why they get forgotten.

Change	Effective	What still works
NLAuth for RESTlets ends	2027.1	Existing integrations using the IssueToken endpoint are excluded from this end of support
No new TBA integrations	2027.1	Existing TBA integrations keep working; full TBA end of support tentatively 2028.1
PKCE required for OAuth 2.0 auth code flow	2027.1	Existing integrations without PKCE remain functional

Your action in 2026 is an inventory, not a migration: which integrations authenticate how, who owns each one, and which vendor needs a ticket opened. Our developers and IT architects breakdown has the technical detail, and the NetSuite API guide covers the OAuth 2.0 target state.

---

Advanced Record Customization: an override layer worth understanding early

Advanced Record Customization (ARC) appears at Customization > Advanced Record Customization. It is a centralized layer for reviewing, managing, and overriding record definitions from one place, applied at account level, covering custom record types, custom transaction types, and selected standard record types.

The behaviour to internalise before anyone starts using it:

When an ARC override exists, changes made elsewhere in NetSuite — or through installed partner solutions — are not applied.

That is a strong override. If a SuiteApp vendor ships an update and it appears to do nothing, ARC is now on the list of things to check. Decide who in your organisation is allowed to create overrides before it becomes a debugging mystery.

The first attribute ARC can override is AI Description. From ARC you can view and filter record types with their effective AI descriptions, identify which use overrides, create and update overrides, add descriptions for SuiteApps and bundles whose owner supplied none, compare default against override, and revert.

AI Description itself is now available on custom records, fields, and transaction definitions for all customers — up to 280 characters, with an Optimize for AI action. These descriptions are what NetSuite's AI features read to understand your custom objects, including the AI Connector Service that exposes NetSuite data to external AI platforms over MCP. Governance of that field is a real administrative responsibility now, not documentation housekeeping.

---

Compliance 360: a role that finally fits the work

Compliance 360 SuiteApp 3.0.0 adds four things, and the first solves a genuine permissions problem.

The Compliance Audit Supporter role is for people who help complete audits but should not have the broader access a Compliance Officer role carries. Supporters can mark assigned audit controls as passed or failed, and can be assigned audit control line items — at which point they get an email with the audit details, the audit control ID, and a link. They do not get dashboard or activity log access. If you have been over-granting Compliance Officer because there was nothing smaller, this is the fix.

The rest:

• Attachments on individual audit control line items. Multiple files per line item, PDF/DOC/DOCX/XLS/XLSX/JPG/PNG/TXT/ZIP, 10 MB total. Evidence now lives with the control it evidences.
• Total Audit Trend portlet on the dashboard — a bar graph of audit count per month over 12 months, clickable through to that month's count and statuses.
• New Audit list filters for audit type, audit supporter, subsidiary, department, class, and location.

---

Timesheets: expanded fields and a real audit trail

If you track time through Time Tracking, New Weekly Timesheets, or Enhanced Timesheets with WFM Wage Rules, Start Time and End Time fields have expanded availability on weekly timesheets and time tracking forms. What exactly changes depends on which features you have enabled.

Two consequences for admins:

• Saved search and SuiteScript support. The fields are available in saved searches, CSV export results, and SuiteScript via the Record Browser. They are not yet available for SuiteAnalytics datasets and workbooks, CSV import, or REST web services — so plan reporting accordingly.
• Timesheets now generate system notes. Changes to Start Time, End Time, and Duration record who changed them, when, and the new values, whether the change came through the UI or SuiteScript.

That second one is the answer to every "who edited this timesheet" question you have previously been unable to answer.

---

Smaller administrative changes

• Units type records are importable via CSV. Previously you created or updated units types and their units one at a time; now you can do it in a single file. Setup > Import/Export > Import Tasks > Import CSV Records, choose Accounting as the import type and Units Type as the record type. It uses your existing permissions and needs nothing beyond the Multiple Units of Measure feature enabled.
• Excel exports default to .xlsx. Lists, saved searches, and reports now export in the modern format rather than legacy .xls. Check any downstream automation keyed to the old extension.
• Currency context for currency custom fields lets you associate a currency with values that previously stored bare numbers, so reports render them correctly. Optional, and existing fields are unchanged until you configure it.

---

Projects: five new health indicators

Not strictly an admin feature, but you will be the one enabling it. Project Indicators gains five indicators, running daily at midnight, requiring the Project Management feature (and in some cases additional features):

• Planned vs. Actual Time Overrun — actual logged time exceeds planned, for the same day, resource, and task.
• Overdue Tasks — tasks incomplete after their end date.
• Project Resource Coverage for Remaining Work — whether assigned resources have enough available hours to finish remaining work before the task end date, accounting for other assignments and approved time off.
• Project Margin Indicator — recognized project revenue against total project cost.
• Unbilled Approved Charges — approved charges still not billed.

That last one tends to pay for the configuration effort on its own.

---

What we would test first

1. The passkey and 2FA rollout, including the quarterly authenticator prompt, before users self-serve into a lockout.
2. ARC governance — decide who can create overrides before an override explains why a partner SuiteApp update did nothing.
3. Your authentication inventory, against the 2027.1 dates in the table above.

Your account's upgrade date is in the New Release portlet on your dashboard. The rest of the series — finance, developers, operations, and sales and pricing — is indexed on our complete NetSuite 2026.2 breakdown, which also lists every change by feature area. For the wider 2026 cycle, see the NetSuite 2026 release notes hub.

Frequently asked questions

What clients ask before signing

Can NetSuite users log in without a password in 2026.2?expand_more

Do users still need an authenticator app if they set up a NetSuite passkey?expand_more

What is Advanced Record Customization in NetSuite 2026.2?expand_more

What is the Compliance Audit Supporter role?expand_more