myID App: Setting Up Your Practice and Your Staff

The myID app proves who you are when you sign in to government services. Each person in your practice sets up their own credential, then receives separate business authorisation. For ordinary agent access, start with Standard identity strength and the permissions their job needs.

Setting Up the Credential for the Principal

Set up your own myID before linking the practice in Relationship Authorisation Manager (RAM). A new staff member follows the same personal setup, then accepts your authorisation.

You need a compatible smart device, a personal email you can keep and your identity documents. You must be at least 15 to create myID.

Follow the official myID setup instructions:

1. Download the app through the official App Store or Google Play links on the myID website.
2. Select No, I have not used myID if this is your first setup.
3. Enter your personal email, create a password and enter your full name and birth date.
4. Verify documents for the identity strength you need. Confirm the app displays that strength before continuing.

Keep the credential personal. Helping a colleague read the instructions is appropriate. Creating myID in their name, holding their password or approving their sign-ins gives you access under their identity. Each person must complete their own verification and approve their own sign-ins.

On a replacement phone, select Yes, I have used myID and use your latest myID email. Re-verify your documents. A phone backup does not establish the required identity strength on the new device. Each device has its own verified strength, although your myID can be used across several devices.

The device-management guidance explains recovery and removing old devices. Using another email to start again can lock your myID.

Identity Strength and What Each Level Unlocks

Identity strength measures the evidence used to establish your identity. RAM authorisation determines which business you can act for. A Strong credential alone gives you no authority over the practice or its clients.

Strength	Documents and verification	Practice use
Basic	Personal details only. One verified document still leaves Basic.	Restricted access through the ATO’s Basic-user arrangements if Standard cannot be achieved.
Standard	Any two accepted documents. Add another document before Medicare becomes available.	Ordinary authorised-user access and RAM administration, subject to service permissions.
Strong, passport route	Australian passport and photo verification, plus citizenship certificate, licence or learner’s permit, or Medicare.	Required for a principal authority linking the business online.
Strong, WA licence route	WA licence or learner’s permit and photo verification, plus one of birth certificate, visa, ImmiCard or citizenship certificate, then Medicare.	Another route to Strong for eligible WA licence holders.

Standard accepts an Australian passport, licence or learner’s permit, birth certificate, Australian visa using a foreign passport, ImmiCard, citizenship certificate or Medicare card. An Australian passport must be current or no more than three years expired. The setup page lists the permitted combinations.

Strong requires a face check against the passport or eligible WA licence photo. Grant camera access and follow the live photo prompts. Use a well-lit space and remove anything covering your face. If a document fails, compare the entered details with the document and follow the document-specific verification instructions.

Strong is required to link the practice online as a principal authority. A principal unable to link online needs at least Standard for an alternative linking method. Ordinary staff can act as Authorised users with Standard or Strong. The RAM identity-strength requirements separate these jobs.

Basic is a fallback with additional ATO identity checks and restricted functions. It cannot administer RAM, access Access Manager or lodge forms with a financial impact. Do not give a new admin officer Basic access and assume it covers every lodgement. Use Standard where the person can achieve it.

Adding Staff and Linking Them in Relationship Authorisation Manager

Authorise each staff member against the practice’s ABN after they create their own myID. The principal authority links first. A principal authority or authorisation administrator can then create staff authorisations.

For a new admin officer, ask for the name shown in myID and an individually accessible business email. The business email receives RAM notifications and can differ from the personal email used for myID.

Follow RAM’s create-an-authorisation instructions:

1. Sign in to RAM and select View or manage authorisations, machine credentials and cloud software notifications.
2. Choose the practice and select Add new user.
3. Choose Standard user for someone with Standard or Strong myID, or Basic user for the restricted fallback.
4. Set the person’s details and access. Select the organisation or service checkboxes required for their work.
5. Leave authorisation administrator and machine credential administrator set to No unless those duties belong to the person’s job.

An admin officer handling agent work will normally be an Authorised user. Authorisation administrator adds the power to manage other people’s authorisations. Machine credential administrator manages machine credentials. A Basic user has limited service access and an authorisation lasting up to 12 months.

RAM emails the staff member an authorisation request and code. Send them the acceptance guidance and tell them which practice ABN they must see. They sign in using their own myID and accept within seven days.

Set the necessary ATO permissions in Access Manager. Ask the staff member to sign in to Online services for agents and confirm the practice and assigned functions are available. A successful app sign-in alone does not prove the setup is finished.

Correct: The staff member uses their personal myID and the practice grants job-specific access.

Incorrect: Everyone uses the principal’s phone to approve sign-ins.

Continue with managing practice authorisations for permission changes and working in Online services for agents for portal tasks. A client’s nomination of your practice is a separate step.

myID and myGov Are Not the Same Thing

myID proves your identity when you sign in to a participating service. myGov is your personal account for linked government services, such as Medicare and your own ATO information.

The practice uses myID with its RAM authorisation for agent access. A taxpayer uses their own myGov account for personal services and can connect myID as a sign-in option. Their myGov account does not grant your staff practice access.

myGovID is the former name of myID. The rename preserved existing details and identity strength, so it did not require a new credential. AUSkey belongs to the retired access arrangements. Avoid setup instructions that tell staff to obtain an AUSkey or create a second identity because the app changed name.

Australian digital-ID legislation does not impose a general requirement for every Australian to create myID. The Digital ID Act guidance describes voluntary use and privacy safeguards. That general position is separate from the sign-in requirements of a particular online service. Staff still need the credential and business authorisation required for the practice’s chosen ATO access route.

What to Do When a Staff Member Leaves

Remove the departing person’s business authorisation when it ceases to be valid. Their myID belongs to them and continues outside your practice. Deleting their credential is not your offboarding step.

Use this starting-point leaver check alongside your existing exit procedure:

1. In RAM, open View or manage authorisations, machine credentials and cloud software notifications. Select the practice, select Remove against the user and confirm.
2. Review the person’s access across every practice entity. Remove remaining ATO access and separate access to tax software, email and document systems.
3. Check any administration rights, machine credentials and software access they managed. Arrange replacements without sharing personal credentials.
4. Confirm the authorisation list contains no remaining access for that person. Record who checked it and when.

A removed RAM authorisation cannot be reinstated. RAM’s removal guidance also distinguishes principal authorities: an online-linked principal remains authorised until removed as an eligible individual associate in the Australian Business Register.

For a departing partner or change of principal, update the underlying business records and establish the incoming principal’s access before relying on ordinary user removal. Review access across each entity, because removing one practice authorisation does not resolve every business relationship.

When the App Will Not Let Someone in

Match the symptom to the failed step before resetting the app. A working myID can still lack business authorisation or an ATO permission.

Symptom	First check	Action
New phone cannot sign in	Latest myID email and verified strength on that device	Complete existing-user setup and re-verify documents.
Document will not verify	Document details and issuer-specific instructions	Correct entry errors or resolve incorrect records with the issuer.
Names differ	Names on the documents and the verified name used by the service	Follow the name-change guidance or use accepted documents with matching names.
NWK000003	Internet connection	Try another connection, log out and retry after five minutes.
App works but practice access fails	Accepted RAM authorisation and ATO permissions	Ask the practice administrator to check the business and assigned access.

The myID error guide documents NWK000003 as a connection issue. After five failed document attempts, the documented waiting period is 24 hours. Stop repeated guesses and check the details first.

For unresolved myID problems, call myID support on 1300 287 539, option 2 then option 1. Have the error code and affected step ready. Support can investigate account and verification problems. The individual still completes personal verification, while the practice administrator fixes business permissions.

Keep urgent work moving through another staff member who already has their own credential and the required permissions. Assign the work to that person and retain the normal review. Never solve a lockout by lending a phone or password.

Scams and the Questions Clients Ask

myID scams commonly use false security warnings or requests to reconfirm identity details. A message claiming the rename requires a fresh setup is also a warning sign.

myID says it does not send SMS messages. It never emails a request to sign in through a link or QR code, provide personal details through a return message or download a file. Open the official service independently instead of following the message. The myID scam guidance links to ATO scam alerts and explains reporting.

Yes, myID has government accreditation and uses encryption and device security to protect identity information. Safe use also depends on keeping the credential private and rejecting sign-ins you did not start. The myID security guidance says document copies are not stored or accessible in the app. Core details are held there. The wider service retains verification records under its privacy notice, so deleting the app does not erase every record.

If a client has entered details on a fake site, tell them to contact myID support immediately. They must secure the credential, review sign-in history and remove unrecognised devices using the official recovery guidance. If their myGov account is affected, follow myGov’s scam-recovery steps as well.

For your practice, treat a suspected stolen staff credential as an access incident. Review its business authorisations immediately and apply your practice cyber-security response while the individual secures their identity.