Security & Sign-On FAQ
Answers to common setup and operating questions about Security & Sign-On.
For what it is and how to set it up from scratch, see the
Security & Sign-On Overview.
Setup
Do I need to configure password rules before they take effect?
No. Password complexity is enforced from the start. A password needs at least 8 characters, with uppercase letters, lowercase letters and numbers. Special characters are not required by default. Passwords never expire by default (Password expiration (days) is 0). Change any of these at Admin → Sign-in Policies.
Which roles must use two-factor authentication by default?
Super Admin and Administrator. People in these roles must enrol at their next sign-in, even when Require Two-Factor Authentication for all users is off. Change the list under Require only for specific roles on the Sign-in Policies page. Service accounts are always exempt, because they cannot answer an interactive challenge.
How do I add Okta, Ping, Auth0, OneLogin or another OpenID Connect provider?
Add it as an OpenID Connect configuration at Admin → SSO Configuration.
- Click New Configuration and choose OpenID Connect as the Provider Type.
- Under Identity provider, pick Okta, Ping Identity, Auth0, OneLogin or Other OpenID Connect provider. The choice pre-fills the form and names the button on the login page.
- Enter the Issuer URL, Client ID and Client secret. The issuer must be a plain
https://address with no query or fragment. - Copy the Redirect URI shown on the form into your identity provider. Also copy the Mobile app redirect URI if people sign in from the mobile or desktop app.
- Save, click Test, then enable the configuration.
The Initiate login URI appears after you save; it lets people start from the provider’s own app tile, such as the Okta dashboard. The client secret is stored encrypted and never shown again. An OpenID Connect configuration always belongs to your organization — it cannot be a shared system configuration or an API-only integration.
Permissions and access
Who can sign people out, revoke API tokens or read the authentication log?
Only Super Admins. Sessions & Tokens and Authentication Log appear in the Admin menu’s Security section only for Super Admins, and both pages refuse anyone else. Administrators can view and change the Sign-in Policies and SSO Configuration pages.
Does configuring SSO require a specific Platform edition?
No. SSO and SCIM provisioning are included in every edition — Platform Lite, Standard and Enterprise. Administrators can open the SSO Configuration and SSO Logs pages in any edition.
Day-to-day
Can I run more than one SSO provider at the same time?
Yes. You can mix provider types — for example SAML for one division and OpenID Connect for another — and add several of the same type. Every enabled configuration appears as its own button on the login page. The SSO Configuration page includes a login page preview showing exactly which buttons people see right now.
What happens when I require two-factor authentication for everyone?
People who have not enrolled are sent to the two-factor setup screen at their next sign-in — they are not locked out. They scan a QR code with an authenticator app and receive 10 one-time backup codes. Each backup code is 8 characters and works once. Until they confirm a 6-digit code from the app, they cannot get past the setup screen. Someone who signs in with a one-time code sent to their email or phone is not asked for an authenticator code — that code counts as the second factor.
How do I reset someone’s two-factor authentication after they lose their phone?
Go to Admin → Users, open the person’s row menu, and choose Disable 2FA. This clears their authenticator and backup codes. If their role still requires two-factor, they set it up again at their next sign-in. Only a Super Admin can disable a Super Admin’s two-factor authentication, and you cannot disable your own here. If the person still has a backup code, they can sign in with it instead.
What does the NIST AAL2 badge on the Sign-in Policies page mean?
It shows whether your session settings meet NIST 800-63B AAL2. That means an inactivity timeout of 60 minutes or less and an absolute timeout of 24 hours or less. If any setting goes past those limits, the badge reads “Outside AAL2” and lists each reason. Nothing is blocked — the badge only reports.
Can people register themselves without an admin creating their account?
Only if you turn on Allow Self-Registration on the Sign-in Policies page; it is off by default. There is no approval step. Anyone with your registration link gets an active account straight away, joins as a Member, and has the password emailed to them. Share the link only where you would be comfortable granting access.
Why is it asking me to confirm it’s me before I change my password or PIN?
To change your own password or PIN, you first confirm your identity. On the Security & Password card, type your current password or PIN in Current password or PIN, then enter the new one. If you sign in with your organization’s single sign-on and don’t know a password, click Confirm it’s you first. That check accepts your password, your PIN, a fresh single sign-on or a one-time code. A successful check lasts 15 minutes. After 5 wrong tries, the check is locked for 15 minutes. If you save without confirming, your old password or PIN stays in place and the page tells you why.
How do I connect my Microsoft account so I can sign in with Microsoft?
Go to Account settings → Security and find the Sign-in accounts card. Click Connect Microsoft account, confirm it’s you, then sign in to Microsoft. The card appears only when your organization has Microsoft Entra ID sign-in set up and enabled. You can disconnect an account you connected yourself, but not your only way in. An account marked Managed by your organization can only be changed by an admin.
When something looks wrong
“I can’t log in — it says my account is locked”
The person went past the maximum number of failed sign-in attempts (5 by default). A lock lasts 60 minutes and clears on its own; this duration is fixed and not a setting. Trying again while locked does not restart the clock. Completing a password reset ends the lock early. A locked account cannot sign in with a one-time code either.
“I’m being asked for a verification code and I don’t know what that is”
Two-factor authentication is required for the person’s role. They set up an authenticator app, such as Google Authenticator or Microsoft Authenticator, by scanning the QR code on the setup screen. If they set it up before and lost their phone, they can enter one of their backup codes instead. An admin can also reset it with Disable 2FA on Admin → Users.
“The SSO button isn’t showing on the login page”
Check three things:
- At least one configuration for that provider is enabled at Admin → SSO Configuration, and its Test passes.
- The provider is not switched off on the SSO Settings page.
- It is a sign-in configuration, not one marked API only — those never appear on the login page.
The login page preview on the SSO Configuration page shows the buttons people see right now.
“Microsoft sign-in says it couldn’t confirm my email address belongs to my organization”
This happens with a Microsoft sign-in that serves more than one Microsoft tenant, when Microsoft can’t vouch for the email address. The person signs in another way first, such as their email address. Then they connect Microsoft under Account settings → Security → Sign-in accounts, and Microsoft works from then on. An admin can instead add the person’s email domain to the allowed email domains on that Microsoft Entra ID configuration.
“I keep getting signed out”
Check the session settings on the Sign-in Policies page:
- Sign out after inactivity (minutes) — 60 minutes unless you set another value.
- Always sign out after (hours) — 24 hours by default; it signs people out even while they are active.
- Also sign everyone out every day at — optional; a set time ends every session at that time in your business’s time zone.
There is no “Remember me” option. When a session ends, people sign in again.
“The one-time sign-in code I received isn’t working”
Codes expire after 15 minutes by email or 10 minutes by text message. After 5 wrong entries, the code stops working and the person must request a new one. People can request 3 codes per 5 minutes, with a 60-second wait between resends. If Enable OTP Login (Login with Code) is off, the sign-in-with-code option does not appear at all.
“Our SSO was working and now it’s failing”
Open the configuration at Admin → SSO Configuration and click Test. For SAML, the test warns when the identity provider’s certificate expires within 30 days. It reports “Certificate EXPIRED on [date]” once it has, and the fix is to paste the new certificate from your identity provider. For OpenID Connect, the test reads the provider’s discovery document, sign-in endpoints and signing keys live, so a changed issuer or rotated setup shows up there. Admin → SSO Logs lists each attempt with the configuration it used, which isolates the broken one when several are active.
Licensing and limits
What are the allowed ranges for password, session and log settings?
| Setting | Allowed range |
|---|---|
| Minimum password length | 8–64 characters |
| Password expiration | 0 (never) to 365 days |
| Maximum failed login attempts | 1–10 |
| Account lockout | 60 minutes (fixed) |
| Sign out after inactivity | 5–10,080 minutes (up to 7 days) |
| Always sign out after | 1–720 hours (up to 30 days) |
| Remember for | 1–90 days |
| Keep the authentication log for | 30–2,555 days (about 7 years) |
The authentication log keeps 395 days (13 months) unless you set another value. Entries older than your setting are pruned once a day. An authentication log export is capped at 50,000 rows.
More help
- Security & Sign-On Overview
- Users, Roles & Permissions
- Ask AI — the assistant answers security and sign-on questions from these articles.