AOA website security updates 2026

Beginning Wednesday 12 August, logging in to the AOA website will look different, and users will have additional but non-mandatory options for access. 

Users that have not logged in recently will need to set up a new password.

In short

  • Additional options for logging in will be available but are not mandatory.
  • These updates apply only to the AOA website – access to other platforms such as the AOANJRR portal and TIMS will stay the same.
  • If you have not logged in to the website in the past six months, next time you do so you will need to set up a new password.
  • Optional passwordless login will become available through the use of passkeys.
  • Trusted devices will be able to stay logged in between sessions.
  • These changes are being implemented to keep up to date with contemporary cybersecurity standards.

The details

Passwords

New AOA passwords will require increased complexity: a minimum of twelve characters, at least one upper-case and one lower-case letter, at least one number and at least one special character.

We appreciate that this change may be frustrating and recommend the use of a password management service from a reputable provider.

These changes will also allow the use of passkeys to remove the need to enter a password.

Authenticator apps

If you log in with a password, you will still need multifactor authentication. You'll be able to use an authenticator app, or you can continue using one-time passcodes delivered by email or SMS.

Manage account

A new ‘Manage account’ page will be available after logging in. On this page, you’ll be able to review and adjust your security settings, including changing your password or setting up authentication options.

Passkeys

When you first log in after these changes go live, you’ll be provided the option to set up a passkey. Passkeys allow logging in using hardware security such as FaceID, TouchID or Windows Hello for authentication as an alternative to entering an ID and password.

To set up a passkey, follow the prompt or access the passkeys section of your ‘Manage Account’ menu. The system will guide you through a simple process to link your account to a passkey.

If at any point you need to access your account when your set passkey is not available, you’ll be able to use a different security process to access your account – it’s an additional option for convenience, not a mandatory process.

Trusted devices

You’ll now be able to set a device to keep you logged in between sessions. This will remain in place for a set period so long as nothing triggers a reset of your browser settings and you’re using the same device and browser. The ‘Active sessions’ section of the new account-management page will allow you to review and revoke trusted devices.

User guides

If you experience any difficulty accessing your account, please review the guides or contact technology@aoa.org.au

We thank all users for their patience as we keep AOA's cybersecurity aligned with contemporary standards.