EIf you see the error below when logging into ExtendSync, it means your NetSuite role does not have the permissions required for Token-Based Authentication (TBA):
“The WSDL version being used requires Token Based Authentication (TBA). Please use TBA or choose another WSDL version.”
ExtendSync strictly follows NetSuite’s security model and requires certain permissions so it can authenticate using NetSuite’s Three-Step Authorization flow, which supports MFA and SSO.
This issue is resolved by enabling User Access Tokens and related permissions on your NetSuite role.
How to Fix the TBA Error
Ask your NetSuite Administrator to update the permissions for the role you use to log in to ExtendSync.
Go to
Setup → Users/Roles → Manage Roles → Edit (or Customize)Open Permissions → Setup
Add the following permissions set to Full:
SOAP Web Services
User Access Tokens
Log in using Access Tokens
Save the role.
Close Outlook, then relaunch the ExtendSync app and log in again.
After these permissions are added, ExtendSync will be able to authenticate using Token-Based Authentication as required by NetSuite’s WSDL.
Why This Is Required
NetSuite requires that integrations using the current WSDL version authenticate via Token-Based Authentication, not username/password.
ExtendSync uses NetSuite's secure, standards-based Three-Step Authorization (3SA), which supports:
Multi-Factor Authentication (MFA)
Single Sign-On (SSO)
Any SAML-based Identity Provider (Okta, Azure AD, Google, etc.)
This ensures your org meets NetSuite’s modern security requirements.
Need Help?
If you've updated the permissions and still see the error:
💬 Chat with us (bottom-right of this page)
📧 Email cloudextend-support@celigo.com
Please include:
The full error message
Your NetSuite role name
Your Microsoft 365 email
A screenshot of your role permissions (Setup tab)