As part of our ongoing commitment to security and authentication best practices, we are preparing to deprecate password-based login for Smartsheet accounts. Our goal is to transition to more secure authentication methods, such as email-based Time-Based One-Time Passwords (TOTP) and eventually full two-factor authentication (2FA) for non-SSO user logins.
We know this is a significant change, and we want to ensure a smooth transition for all our customers. That’s why we’re restarting our customer communication and gathering feedback on various scenarios where password deprecation may introduce challenges.
Here are a few key customer challenges we’re addressing:
- Service Accounts: Many customers currently use service accounts authenticated via email/password for API integrations. As a security best practice for API authentication, we propose that relevant customers authenticate API via user access tokens. In the future, we plan to introduce dedicated service accounts. For help please refer to this community post.
- Business Plan OTP Restrictions: Some customers use shared laptops or share Smartsheet accounts at events. To maintain your access while ensuring ample security protections, we recommend leveraging external collaboration features instead of sharing the same Smartsheet account. When assets are shared with these external users, they will create individual Smartsheet accounts enabling them to access the shared assets as external collaborators.
- Accounts Without Associated Mailboxes: If your organization has Smartsheet accounts registered to emails without mailboxes, our recommendation is to update those emails to active mailbox accounts or use alternative authentication methods.
We understand that every organization has unique workflows, and we want to hear from you! Please share your thoughts, concerns, and any additional scenarios we should consider in the comments below. Your feedback will help us refine our approach and ensure we provide the best possible transition strategy.
Our rough target timeline for password deprecation is early H2 2025. Now is the time to engage, so let us know what you think!
👉 Join the conversation and let us know how this change impacts you!
