Security & Sign-On FAQ
Answers to common setup and operating questions about Security & Sign-On.
For what it is and how to set it up from scratch, see the
Security & Sign-On Overview.
Setup
Do I need to configure password rules before they take effect?
No. Password complexity is enforced by default: minimum 8 characters with uppercase, lowercase, and numbers required. Special characters are not required by default. Passwords never expire by default (expiration is set to 0 days). Adjust any of these on the Sign-in Policies page at Admin → Security Settings.
Which roles must use two-factor authentication by default?
Super Admin and Administrator. Even when business-wide 2FA is off, users in these two roles are required to enrol at their next login. You can add or remove roles from the required list on the Sign-in Policies page. Service accounts are always exempt — they cannot perform an interactive challenge.
Permissions and access
Who can revoke user sessions and API tokens?
Only Super Admins. The Manage Sessions & Tokens page (Admin → Security Settings → Manage Sessions & Tokens) requires the Super Admin role. Regular Admins can view and edit sign-in policies but cannot revoke sessions or tokens.
Does configuring SSO require a specific platform tier?
Yes. SSO configuration requires the Standard platform tier. The Lite tier does not include it. The SSO Configurations page (Admin → SSO Configurations) enforces this before allowing access.
Day-to-day
Can I run multiple SSO providers at the same time?
Yes. You can have multiple configurations for the same provider type — for example, two SAML IdPs for different divisions. All enabled configurations appear as buttons on the login page. The SSO Configurations index includes a login page preview showing exactly which buttons users will see.
What happens when I require 2FA for all users?
Users who have not enrolled are redirected to the 2FA setup screen on their next login — they are not locked out. They scan a QR code with an authenticator app and receive 10 one-time backup codes (8-character hex codes, each usable once). Once they confirm a 6-digit TOTP code, their account is enrolled. Until they complete setup, they cannot proceed past the setup screen.
Does OTP login bypass two-factor authentication?
Yes. When a user logs in via OTP (one-time code sent by email or phone), the one-time code serves as the second factor. They are not prompted for an authenticator-app code after entering the OTP.
How do I reset a user’s 2FA if they lost their device?
An admin can disable and re-enable 2FA from the user’s profile page. The user is then redirected to the 2FA setup screen on their next login to scan a new QR code. If the user still has their backup codes (10 are issued at setup), they can enter a backup code instead of the authenticator code — each backup code is consumed on use.
What does the NIST AAL2 compliance badge on the Sign-in Policies page mean?
It shows whether your session settings meet NIST 800-63B AAL2 requirements: inactivity timeout at or below 60 minutes, absolute timeout at or below 24 hours, and Remember Me disabled. If any setting exceeds those thresholds, the badge shows “Outside AAL2” and lists which settings are non-compliant.
Can users register themselves without an admin creating their account?
Only if you enable self-registration on the Sign-in Policies page (off by default). Even with self-registration enabled, admin approval is still required before the account becomes active. Pending registrations appear at Admin → Registrations for an admin to approve or reject.
When something looks wrong
“I can’t log in — it says my account is locked”
The user exceeded the maximum failed login attempts (default 5). The lockout clears automatically after the lockout duration (default 30 minutes). An admin can also manually unlock the account from the user’s profile. Locked accounts cannot use OTP login either — the user must wait for the lockout to expire or be manually unlocked.
“I’m being asked for a verification code and I don’t know what that is”
Two-factor authentication is required for the user’s role. They need to set up an authenticator app (Google Authenticator, Microsoft Authenticator, or similar) by scanning the QR code on the setup screen. If they already set it up and lost their device, they can enter one of their backup codes instead. An admin can reset their 2FA from the user’s profile if needed.
“The SSO button isn’t showing on the login page”
Three things to check: (1) at least one SSO configuration must be enabled — go to Admin → SSO Configurations and verify a provider is toggled on and its connection test passes; (2) SSO requires the Standard platform tier; (3) if using a system-level configuration, confirm that the per-business SSO setting for that provider type is also enabled.
“I keep getting signed out”
Check three settings on the Sign-in Policies page: inactivity timeout (default 60 minutes), absolute timeout (default 24 hours), and whether Remember Me is enabled (default off). If Remember Me is off, the inactivity timeout applies. The absolute timeout signs everyone out regardless of activity — even active users are signed out after 24 hours by default.
“The one-time login code I received isn’t working”
Codes expire after 15 minutes (email) or 10 minutes (SMS). After 5 wrong attempts the code is invalidated and the user must request a new one. Users are rate-limited to 3 code requests per 5 minutes with a 60-second cooldown between resends. If OTP login is disabled for your business, the login-with-code option does not appear on the login page at all.
“My SAML SSO was working and now it’s failing”
Check the SSO health status at Admin → SSO Configurations. The system warns when a SAML certificate expires within 30 days. If the certificate has already expired, the health check shows “Certificate EXPIRED on [date].” Upload the new certificate from your identity provider. Also check Admin → SSO Logs for failures tied to that configuration — the log shows the specific SSO configuration used for each attempt, which helps isolate a misconfigured provider when multiple are active.
Licensing and limits
How long are authentication logs kept?
Default is 395 days (trailing 13 months, aligned to SOC 2 and ISO 27001 evidence windows). You can set retention from 30 to 2,555 days (~7 years) on the Sign-in Policies page. Pruning runs daily. CSV exports are capped at 50,000 rows.
Are there limits on password or session settings I should know about?
| Setting | Range |
|---|---|
| Minimum password length | 8–64 characters |
| Password expiration | 0 (never) to 365 days |
| Max failed login attempts | 1–10 |
| Lockout duration | 1–1,440 minutes (up to 24 hours) |
| Inactivity timeout | 5–10,080 minutes (up to 7 days) |
| Absolute session timeout | 1–720 hours (up to 30 days) |
| Remember Me duration | 1–90 days |
| Auth log retention | 30–2,555 days (~1 month to ~7 years) |
More help
- Security & Sign-On Overview
- Users, Roles & Permissions
- Ask AI — the assistant answers security and sign-on questions from these articles.