Security · password policy, session and allowed IPs
The Settings, Security screen sets the password rules, the idle time that ends a session and the list of network addresses allowed to reach the organization. It applies to everyone in the organization and only administrators can change it.
Every organization has a different tolerance for risk. A small team may want nothing more than a reasonable password; a company that answers to auditors usually needs a long password, periodic rotation and access restricted to the office network. This screen brings those three decisions together in one place.
Open Settings and click Security. Your changes apply to the whole organization from the moment you click Save.
Password policy
- Minimum length: the minimum number of characters. The default is 8 and the accepted range runs from 6 to 128.
- Validity (days): after this period the person is required to change their password at the next sign-in. Zero means the password never expires, which is the default.
- Minimum age (hours): how long must pass before the person can change it again. It stops someone from changing the password several times in a row just to get back to the old one. Zero turns the rule off.
- Do not reuse the last N passwords: how many previous passwords are off limits. The default is 5 and the maximum is 24.
- Required complexity: four independent checkboxes, Require uppercase letter, Require lowercase letter, Require number and Require symbol. All start checked.
These rules apply when a person changes their password inside the product, whether in My account or on the forced change screen. If the new password repeats one of the stored ones, the message is This password was used recently. Choose a different one.
Session
The End session after inactivity (minutes) field signs out anyone who sits idle. Zero turns the rule off. The countdown happens in the browser, which watches for mouse movement, keyboard, scrolling and touch, and also on the server, which refuses the session when the last sign of presence is older than the limit. In other words, leaving the tab open does not keep the session alive by itself.
IP access restriction
- In the text box, write one address or range per line.
- An exact address looks like 203.0.113.10. A range uses slash notation, such as 10.0.0.0/24.
- Click Save. The list now applies to the whole organization.
- An empty list means access is allowed from anywhere. That is the default.
- Slash ranges work for addresses in the classic four number format. Addresses in the newer, longer format are only matched by exact equality, so do not write ranges for those.
- When a request arrives with no origin information, access is allowed. That choice keeps a networking detail from locking the entire organization out.
When someone is blocked, they see an access blocked screen, the event goes into the audit trail as Access blocked by IP, and administrators get a bell notification with the address partially masked. Repeated notices for the same person and address pair are grouped by hour so notifications are not flooded.
Emergency actions
- Require a new password from EVERYONE on next access: flags every person in the organization to change their password at their next login. The screen reports how many users the requirement was applied to.
- Sign out all sessions: ends the sessions of YOUR account on every device and browser, and signs you out immediately. This button does not drop your colleagues sessions.
Who can do what
Only people with permission to manage settings can save. If anyone else tries, the screen answers Only administrators can change security. Every change saved here is recorded in the audit trail as Changed security, along with the values that were applied.