Connection 4 of 5 · Identity
Digital identity and RAM: who may act online for a business
Rests on: the ATO’s page on setting up access to Online services for business, with the myID and RAM sites, put in plain words.
To use a government online service for a business, a person generally needs their own myID linked to the business’s ABN, and the link is made in Relationship Authorisation Manager (RAM). The principal authority has to link first; after that, they or an authorisation administrator can authorise others in RAM.
General information about government sign-in for business, not legal or tax advice. The official places to check are the ATO, myID and RAM, whose pages are listed at the foot of this page.
A person’s myIDRAMThe business’s ABN
Connection 4: a personal Digital ID, linked to the business in Relationship Authorisation Manager.
01 A myID belongs to a person
myID is the Australian Government’s Digital ID app. It was called myGovID until the ATO announced the new name on 13 November 2024.
The ATO puts the point plainly for employers: “As myID belongs to them and not the business, your staff should set it up using their personal email address.” The myID site says the same to everyone setting one up: the email address should be personal and not shared or used for work, because the person’s ID documents are linked to it.
Among the things myID’s setup page says a person needs are a smart device, that personal email address, and to be 15 or older, adding that age limits may also apply to some government online services. It says to download the app only from the official app stores.
02 Identity strength
Each online service has a minimum identity strength for access, and a stronger myID opens more services.
| Strength | What it takes | What it opens |
|---|---|---|
| Basic | Personal details only. A person who verifies no ID documents, or only one, stays at Basic. | A limited set of participating government services. |
| Standard | Any 2 Australian documents from myID’s list, which includes a passport, driver licence, birth certificate, visa, ImmiCard and citizenship certificate; a Medicare card is offered only after one of the others is verified. | Most participating government services. For someone who is not the business’s principal authority, myID says Standard is enough for all government online services for business. |
| Strong | Australian identity documents and a check of the person’s photo. | All participating government services. |
The ATO says names should match on the 2 documents, and that a change of name may be shown with a marriage certificate, or with a change of name certificate from Tasmania, South Australia, the Northern Territory or the Australian Capital Territory only.
03 Linking the business
The principal authority, the business owner or person responsible for the business, must be the first person to link the business’s ABN to their myID. The myID site says that person sets up their myID with at least Standard strength and links it in RAM.
RAM’s own page on linking a business online sets a higher bar for that way of linking. Before linking online, it says to check four things:
- the person has a Digital ID with Strong identity strength;
- the business’s details are up to date on the Australian Business Register;
- they are listed there as the sole trader or an eligible individual associate;
- their name matches the one they used for their Digital ID.
RAM says there are other ways to link for someone who can’t link online. Once linked, the person can use government online services for the business and authorise others to do the same. Their authorisation shows as Principal authority and stays in place unless they are removed as an eligible individual associate of the business in the ABR, and any principal authorities already linked get an email telling them.
04 Authorising staff
Only a principal authority or an authorisation administrator can create an authorisation. RAM suggests first checking that the person has set up a Digital ID, that its strength meets the minimum for the services they will use, that their full name matches their Digital ID, and that they have a current business email address only they can open. That address need not be the one on their Digital ID.
- Choose the user type. Someone with a Standard or Strong Digital ID is a Standard user. For a Basic user, only organisations that accept Basic strength are shown, some agencies may ask for more proof of identity, and the user can be authorised for up to 12 months at a time, renewable if still needed.
- Choose any extra role. A Standard user can be made an authorisation administrator, who can create and manage authorisations for the business, or a machine credential administrator. Otherwise they show in RAM as an Authorised user.
- Grant access. Access is given organisation by organisation, and service by service where an organisation allows it.
- The person accepts. The ATO says an employee gets the authorisation request by email and has 7 days to accept it with their myID.
05 Two cases that may not need RAM
Outside tax or BAS agents. The ATO says a business may need to authorise its chosen tax or BAS agent through the agent nomination feature in Online services for business, and not through RAM.
Cloud reporting software. With cloud-based Standard Business Reporting (SBR) enabled software, the ATO says no extra steps are needed because the software provider takes care of it; desktop or locally hosted software may need extra steps.
06 Scams around myID
When it announced the new name in November 2024, the ATO warned of impersonation scams. Its advice then: don’t click suspicious links or open attachments, download the app only from the official app stores, never share or enter a login code for anyone, and treat any prompt during the name change to go to a website to set up a new myID or reconfirm details as a scam. It added that it “will never send an unsolicited SMS that contains a hyperlink”.