Centralized login and authentication policies
The Security Settings page gives Global Administrators a single place to manage login and authentication policies across the entire organization and all its subsidiaries.
From one screen, you can enforce two-factor authentication, manage SSO, set password strength rules, schedule periodic password resets, and configure account validation policies.
⚠️ Only Global Admin users can access and modify Security Settings. Changes made at the parent account level automatically apply to all subsidiaries.
Where to find it
Navigate to Settings > Security settings (under Organization) in the left-hand menu.
Two-factor authentication (2FA) and Single Sign-On (SSO)
Reduce the risk of unauthorized access by enforcing 2FA and SSO across your entire organization. With a single toggle, every user account gains an additional layer of protection, ensuring only verified users can log in.
You can enable either or both of the following:
Two-factor authentication (2FA): requires all users to verify their identity with a second factor when logging in.
Single Sign-On (SSO): enforces SSO as the required authentication method once it has been configured on your account.
💡 SSO configuration is handled by your Customer Success Manager (CSM). The Security Settings page controls enforcement only. Learn more about SSO setup.
Password requirements
Administrators can define and enforce password strength rules to ensure every user meets your organization's security standards. At least one requirement must be enabled at all times.
Available options include:
At least one number: requires at least one numeric character
At least one lowercase letter: requires at least one lowercase character
At least one uppercase letter: requires at least one uppercase character
At least one special character: requires characters such as @, #, ?, etc.
Minimum password length: set the minimum number of characters required
⚠️ These rules apply to all users across the organization and its subsidiaries. At least one password requirement must be enabled at all times.
Account security: periodic password reset
Require users to update their passwords on a regular schedule to keep credentials fresh and reduce exposure from compromised passwords that go unnoticed. You can choose from three reset intervals:
Every 30 days: maximum security
Every 60 days: balanced approach
Every 90 days: minimal disruption
Account validation
Account validation sends a verification email to users to confirm they still have access to their registered email address. There are two options:
Periodic validation for all accounts: sends a verification email to every user on a regular schedule. Ideal for organizations with strict access review requirements.
Validation after failed login attempts: triggers a verification email when an account experiences repeated failed login attempts. This helps detect brute-force attacks early and gives administrators proactive control over account integrity.