Final activation window
HMRC says remaining accounts will be automatically activated between 28 September and 15 October 2026.
Buyer-intent answers
HMRC agents · MFA · access continuity
HMRC Agent MFA: Prepare Before the Final 28 September–15 October Activation
A practical access-continuity checklist for UK tax and accounting practices whose remaining Government Gateway agent accounts will receive multi-factor authentication during HMRC’s final activation window.
Primary query: HMRC agent MFA 28 September 15 October 2026 prepare · Updated 2026-09-07
Direct answer
What should an accounting or tax practice check before HMRC automatically enables MFA on remaining agent accounts?
HMRC says all remaining agent accounts that have not already activated multi-factor authentication will be switched on at some point between 28 September and 15 October 2026, without a specific activation date for each account. Before that window, practices should inventory agent IDs and users, confirm administrator ownership, choose workable access-code methods, remove outdated MFA settings, test recovery and document how shared operational work will continue if one user is unavailable.
Practical sequence
What to do next
- 01
List every Government Gateway agent ID, the users who rely on it, the administrator and whether MFA is already active.
- 02
For accounts still awaiting activation, select the intended access-code method and remove obsolete phone numbers, devices or settings that could create a lockout.
- 03
Confirm who can administer the account and how access will continue if the primary administrator is absent when MFA is activated.
- 04
Run a short continuity drill covering sign-in, one-time-code receipt, backup ownership and the practice’s escalation route for failed access.
- 05
Record the final settings and owners without storing passwords or one-time codes in the readiness tool.
Decision facts
No exact switch date
HMRC cannot provide each remaining agent with a specific activation date within that window.
Preparation focus
HMRC specifically recommends checking future settings, administrators and access-code methods before activation.
Boundaries
- — A practice’s correct access design depends on its account structure, staffing, device policy and current Government Gateway configuration.
- — This checklist must never collect account passwords, recovery secrets or one-time MFA codes; final account changes happen in HMRC’s own service.
Free proof before paid workflow