Your organization's sign-in policy
هذا المحتوى غير متوفر بلغتك بعد.
The sign-in policy is one set of rules for the whole organization: which ways of signing in are allowed, who needs
two-step verification, and how long people stay signed in. Owners and admins change it in Settings → Security →
Sign-in policy; Settings → Security opens this tab first, next to Single sign-on, Domains, Audit
log and Support access. Change the fields and choose Save. Every change asks you to
confirm your sign-in if your last sign-in was more than 10 minutes ago (step_up_required,
confirming sensitive actions), and every change is
written to the audit log.
Allowed sign-in methods
Section titled “Allowed sign-in methods”Under Allowed sign-in methods, tick any of: Password, Google, Microsoft and Company single sign-on. At least one must stay allowed (“Keep at least one sign-in method.”).
- Password sign-in can be turned off only while the organization has an active single sign-on connection (single sign-on). When you untick Password, the tab warns that people can then only sign in through an active company single sign-on connection.
- Emergency access: even with password sign-in turned off, the owner can still sign in with their password and two-step verification (on by default). An outage at your identity provider therefore never locks the organization out.
- Requiring single sign-on for everyone (enforced SSO) and passkeys are not available yet.
What each method means for the people who sign in is explained in sign in with Google or Microsoft.
Two-step verification
Section titled “Two-step verification”Under Require two-step verification, choose Off, Owner and Admin only, or Everyone (two-step verification). You must have set it up and signed in with it yourself before you can require it, so you cannot lock yourself out.
Session lengths
Section titled “Session lengths”The Session lengths part of the tab has one field per setting:
| Field (setting) | Range | Default | What it does |
|---|---|---|---|
Panel sign-out after inactivity (webIdleHours) | 1 to 720 hours | 12 hours | A dashboard session that is not used for this long ends |
Panel session at most (webAbsoluteHours) | 1 to 720 hours, at least the idle time | 168 hours (7 days) | A dashboard session ends this long after sign-in, even when it is used |
Desktop app signs in again after (desktopReauthDays) | 1 to 365 days | 30 days | The desktop app asks for a new sign-in after this many days |
Company sign-in session at most (ssoSessionMaxHours) | 1 to 24 hours | 12 hours | After a single sign-on, the dashboard checks with your identity provider again after this long |
Company account re-check (ssoRecheckHours) | 1 to 168 hours | 24 hours | The desktop app checks a single sign-on account with the identity provider this often |
Ask for the password again after (maxAgeSeconds) | empty, or 300 to 2,592,000 seconds (5 minutes to 30 days) | empty | How recent a sign-in must be; when set, an older sign-in asks for the password again |
Shorter times end access sooner but ask people to sign in more often. People see and end their own sessions in their profile (sessions and devices).
Errors when saving
Section titled “Errors when saving”| Code | Meaning |
|---|---|
step_up_required | Confirm your sign-in, then save again |
validation_failed | A value is outside its range, no method is allowed, or password sign-in cannot be turned off yet |
version_conflict | Someone else changed the policy meanwhile; reload it and make your change again |
feature_not_enabled | The method or setting is not enabled for your organization yet |
A field with an error is marked on the tab with its message; correct it and save again.