What changed, and when
In August 2025 the NDIA announced that from 10 November 2025 all providers would need myID and RAM to reach the NDIS provider portals, and that PRODA would be discontinued for those portals after that date. The agency said the change better protects participant data. It also said nothing changes about how claims are made: the portals themselves work as before. Once you log in with myID on behalf of a business, you can no longer use PRODA for that business in the NDIS portals, although PRODA still works for some other government services.
Every login now rests on two pieces:
- myID is the Australian Government's Digital ID app. It proves who you are, and it belongs to you as a person, not to your employer. Set it up with a personal email address.
- RAM records who may act on behalf of a business. It links your myID to the business's Australian Business Number (ABN) and to the specific government services you are allowed to use.
What myID identity strength you need
myID has three identity strengths: Basic, Standard and Strong. For the NDIS provider portals:
- Staff, including authorisation administrators and authorised users, need at least Standard. That means verifying two Australian identity documents in the app.
- The principal authority, the owner or director who links the business in RAM, needs Strong. The NDIA's guidance says this needs an Australian passport that is current or expired no more than three years. The myID website also lists a Western Australian drivers licence route.
If a principal authority cannot reach Strong, the NDIA suggests first checking whether another principal authority can link the business and authorise them, and otherwise setting up a Standard myID and calling the RAM support line. See how to set up myID for the current document list.
How RAM authorisations work for staff
RAM has three roles that matter for NDIS providers:
- Principal authority: a person responsible for the business, such as a sole trader, director, trustee, public officer or partner, whose role is recorded with the Australian Business Register, ASIC, ORIC or the ACNC. They must be the first to link the business in RAM.
- Authorisation administrator: a staff member the principal authority (or another administrator) authorises to create and manage authorisations for others.
- Authorised user: can act for the business in the services they are authorised for, but cannot authorise anyone else.
To give someone access, the principal authority or an administrator creates an authorisation in RAM. Before you send it, check the person has a Standard or Strong myID, that their full legal name matches their myID, and that the business email you use can only be read by them. Under Agency access, choose the National Disability Insurance Agency and tick the NDIS Provider Portal service. If that box is not ticked, the person will not get in. Select No for machine credential administrator, which has no use for these portals.
The staff member receives an email with a code and must accept it in RAM within seven days. An expired code can be re-issued by a principal authority or administrator. They then choose Continue with Digital ID on the portal sign in page. The NDIA says a brand new user should wait about 30 minutes before using myplace and 24 hours before using the my NDIS provider portal.
Removing leavers and reviewing access
RAM's own guidance is to maintain authorisations regularly and remove them immediately when they are no longer valid. Our approach:
- Remove a leaver's authorisation on or before their last working day. A principal authority or administrator selects Remove against the user in RAM.
- Remember a removed authorisation cannot be reinstated. A person who comes back needs a new request.
- Check every service the person held, including the NDIS Commission's portals, which are a separate agency in RAM and have their own user accounts.
- A principal authority who linked online cannot be removed in RAM. They stay until they are removed as an associate of the business on the Australian Business Register.
- Use RAM's History function to export authorisation activity, compare it with your staff list and keep the review as evidence.
Which portal does what
- my NDIS provider portal: participants whose plans are in the NDIA's new computer system (PACE). Participant and plan details shared with you, my provider relationship requests, requests for service for support coordinators, reports, employee details, SDA dwelling enrolments and all claim and payment enquiries.
- myplace provider portal: participants on the old computer system, service bookings, your registration and contact details, and all claims and payment requests, including bulk uploads, whichever system the plan is in.
- Integrity portal: only if the NDIA writes asking for more evidence to support your claims.
- NDIS Commission portals: registration, worker screening, incidents, behaviour support and restrictive practices reporting. Run by the Commission, not the NDIA.
The NDIS Commission's portals and their own transition
The NDIS Commission ran its own move from PRODA to myID and RAM, starting 7 December 2025 with a transition period it said was scheduled to end by 30 September 2026. To reach Commission portals, a staff member needs a RAM authorisation for the NDIS Quality and Safeguards Commission service as well as, or instead of, the NDIA one. Self managed and plan managed participants who use the Commission's worker screening portal were told they can keep using PRODA until further notice.
From 12 October 2026 the Commission runs two portals side by side: start new work in the new NDIS Commission Portal and finish work already underway in the existing portal. Staff with an active account in the existing portal carry over, but roles do not map one to one, and access is not shared. If you create or deactivate a user in one portal, do the same in the other. Make sure someone active holds each role you need: Registrant, Access Delegate, Worker Screening Officer, Behaviour Support Lodgement Officer, Restrictive Practice Reporting Officer and Reportable Incidents Officer. The Commission keeps a list of current portal issues.
Common problems and fixes
- Staff cannot log in at all: the principal authority has not linked the business yet, or the NDIS Provider Portal service was not ticked on the authorisation.
- Authorisation code expired: it was not accepted within seven days. Ask an administrator to re-issue it.
- Error after choosing a business: the wrong ABN was selected. Log out and back in and pick the right one. For registered providers, the ABN in RAM must match the ABN registered with the NDIS Commission.
- New user locked out of the my NDIS provider portal: allow up to 24 hours after first access.
- 401 Unauthorized on a Commission portal: the Commission says this happens when someone tried to log in before being authorised. Clear your browsing history and log in again.
- One time codes going to the wrong place: your myID email fills your portal contact details at first login. Update your contact email and phone in myplace to business details, because the NDIA sends codes there when you ask about protected information.
- Pressure to share a login: never do it. myID says not to share your myID or password.
Provider checklist
- Principal authority has a Strong myID and has linked the ABN in RAM.
- A small number of authorisation administrators are set up, with at least one backup.
- Every portal user has their own Standard or Strong myID on a personal email.
- Each authorisation has the right service ticked: NDIS Provider Portal, NDIS Quality and Safeguards Commission, or both.
- Contractors have end dates.
- myplace contact details are business details, not personal ones.
- Commission portal roles are assigned in the new portal, and users are mirrored in the existing portal.
- Leavers are removed in RAM and both Commission portals by their last day.
- RAM history is exported and reviewed against the staff list on a set schedule.
Train your team
Our portal course covers all of this with scenarios, and the related courses cover claiming, privacy and login security:
90 minUsing the NDIS Provider Portals
A practical course for the admin, finance and intake staff who use the NDIS provider portals every day. It explains the three portals and what each one is for, how access now works through myID and Relationship Authorisation Manager after PRODA was retired for the agency's portals, and how we decide who gets access and remove it when people leave. You will learn how plans in the old system and in PACE differ, when service bookings apply and how to be recorded as a my provider. It then covers single and bulk payment requests, reading payment summaries and recipient created tax invoices, common rejection reasons, record keeping, privacy and login security. Two case studies bring it together: a month end payment run and an access review. Duration: 90 minutes.
50 minNDIS Pricing, Claiming and Cancellations
Every claim we make is a statement that we delivered an agreed support at a price the rules allow. This course helps team leaders and managers get that right. It explains how NDIS prices are now set, including the Minister's pricing determination and the pricing schedule, how price limits work, and the core rules for claiming only for supports that were agreed and delivered. It covers non face to face claiming, short notice cancellations as described in the current claiming guidance, record keeping, the stronger payment integrity powers introduced in 2026, and how to report concerns. Two case studies show a weekly claim check and a fair response to a run of cancellations. Duration: 50 minutes.
50 minPrivacy and Confidentiality
Every day we are trusted with deeply personal information about the people we support: their health, their homes, their families and their finances. This course explains what privacy and confidentiality mean in disability and aged care support, the laws that protect personal information, including the Privacy Act 1988 and the Australian Privacy Principles, and how the NDIS Code of Conduct and our privacy policy apply to your work. You will learn how to collect, store, share and dispose of information safely, how to handle requests from family and other services, and what to do if information is lost or shared by mistake. Case studies about a lost work phone and a worried sister show these skills in action. Duration: 50 minutes.
55 minCyber Security Safety
We hold sensitive information about the people we support, including health details, plans, addresses and funding. Cyber criminals target care providers because this information is valuable and because busy staff can be caught off guard. This course shows you how to spot phishing emails, texts and calls, create strong passphrases and use multi factor authentication, keep work phones, tablets and laptops secure, and handle participant information safely in apps, messages and photos. You will also learn what to do if you click a suspicious link or lose a device, and how data breaches are reported under the Privacy Act, then work through two case studies. Duration: 55 minutes.
Frequently asked questions
Can NDIS providers still use PRODA?
Not for the NDIA's provider portals. The NDIA discontinued PRODA for the my NDIS provider portal and the myplace provider portal after 10 November 2025, so access is through myID and Relationship Authorisation Manager. PRODA still works for some other government services.
What myID strength do NDIS provider staff need?
At least Standard for staff, including authorisation administrators and authorised users. The principal authority who links the business in RAM needs Strong.
Who can authorise staff in RAM?
The principal authority, usually an owner or director, and any authorisation administrators they appoint. Authorised users can use the portals but cannot authorise anyone else.
How do we remove a staff member who has left?
A principal authority or authorisation administrator removes their authorisation in RAM. Do it by their last day, check the NDIS Commission portals too, and remember a removed authorisation cannot be reinstated.
Where do I make a payment request, and where do I ask about one?
All claims and payment requests are made in the myplace provider portal. All claim and payment enquiries go through the my NDIS provider portal.
Do the NDIS Commission's portals use the same login?
They use myID and RAM too, but the Commission is a separate agency in RAM, so staff need an authorisation for its service. From 12 October 2026 the Commission also runs a new portal alongside the existing one, and users must be managed in both.
Source: National Disability Insurance Agency. Checked 10/11/2026. Provider Compliance is not affiliated with the Victorian Government.