How people sign in to your organisation, and how strictly, is described in the Security section. This page is a short map for administrators.
What you can set for the organisation
| Setting | Where | Who | Page |
|---|---|---|---|
| Require two-step verification for every member | Settings > Sign-in Policy | Owner | Two-factor sign-in and passkeys |
| Allowed and blocked IP addresses | Settings > Sign-in Policy | Owner | Sessions, lockout and trusted devices |
| Public registration, e-mail verification, lockout threshold | Settings > Authentication & SSO | Admin | Sessions, lockout and trusted devices |
| SAML single sign-on and just-in-time provisioning | SAML SSO | Owner | Single sign-on |
| SCIM provisioning tokens | Settings > SCIM Provisioning | Admin | Single sign-on |
| Signing a member out, suspending a member | Members > member | Admin | Users and roles |
What each person sets for themselves
| Item | Where | Page |
|---|---|---|
| Passkeys | My Profile > Passkeys | Two-factor sign-in and passkeys |
| Active sessions, signing out other sessions | My Profile > Security | Sessions, lockout and trusted devices |
| Trusted devices | My Profile > Security | Sessions, lockout and trusted devices |
| Linked social sign-in accounts | My Profile > Connected Accounts | Your profile, language and time zone |
Quick recommendations
- Give every owner and admin a passkey, and a second one as a backup.
- Turn on Require two-step verification for every member once every member has a second factor.
- Use SAML single sign-on if your company has an identity provider, and SCIM to remove leavers automatically.
- Set an IP allow list only when every member works from known networks, and keep your own address in it.
- Review the audit log for sign-in failures and lockouts. See What is audited.
If a member cannot sign in, see Sign-in problems.