Xero 2 Step Authentication (2SA) is NOW.
AU payroll administrators and subscribers: 2SA compulsory from 11 September 2018 Between 11–21 September, 2SA will become mandatory for all payroll administrators and subscribers. This means they will only be able to access their Xero account once they have set up 2SA. Xero has sent emails to these users already.
All remaining customers: 2SA compulsory from 20 November 2018 All remaining customers invited into an AU Xero organisation will soon require 2SA too. Customers will be invited to opt in to 2SA from 23 October before it becomes compulsory from 20 November.
See these guides or get in touch if you need help.
Xero Central: Set up or disable two-step authentication
Xero Central: Log in using two-step authentication