Authentication

Purpose: password rules, multi-factor authentication, and active-session management for your workspace.

Two separate pages cover this, both under Settings:

• Settings → Security — MFA, passkeys, MFA enforcement policy, recovery codes, active sessions.
• Settings → Password Policy — password complexity and reuse rules.

Password Policy

At Settings → Password Policy:

The policy is enforced whenever a password is set: when someone you invited signs up, on a password reset, and on a password change. A person who belongs to several workspaces must meet the strictest of their policies. Changes apply on the next password a user sets; existing passwords and sessions are not invalidated by a policy change alone. There is no password expiry setting: forced periodic changes are not recommended by NIST SP 800-63B.

Multi-Factor Authentication (MFA)

At Settings → Security, under Two-Factor Authentication (MFA):

• Users can enable TOTP-based MFA (authenticator app) themselves.
• Passkeys — a second MFA method (fingerprint, face, or hardware security key via WebAuthn) alongside TOTP. This did not exist in the earlier version of this guide.
• Recovery Codes — backup codes for account access if a user loses their authenticator device.

MFA Enforcement Policy

This is a single Require MFA for all users switch, not the old "Encourage vs. Require" two-mode toggle — there is no "Encourage" mode that only nudges users with a dismissible prompt. When enforcement is turned on, you can set a grace period during which existing members can still sign in unenrolled: No grace period, 3, 7, 14, or 30 days (not an arbitrary 1–14 day range). The policy panel also shows live MFA adoption — percentage enrolled and a count of users with MFA out of total.

Session Management

At Settings → Security, under Active Sessions: view every active session for your account and revoke one immediately, forcing re-authentication.

What no longer exists

Two sections from the earlier version of this guide describe features that could not be found anywhere in the current settings pages or the auth service:

• Magic Link Login — no admin toggle for passwordless email-link login exists on the Security page (or anywhere else searched). Password (and MFA, if enforced) is the only self-service login method for non-SSO users today.
• Login Attempts and Lockout Policy — there is still no setting for it, but a fixed backoff now applies to every account. After 10 wrong passwords in a row from one network, sign-in for that address pauses on that network only (1 minute, doubling up to 15), so someone guessing cannot lock you out of your own computer. After 10 wrong authenticator or recovery codes in a row, the second step pauses for the account the same way; a password reset ends it. The account owner is e-mailed when either first happens.

If your workflow depends on either of these, verify directly against the running Security page before relying on this note — this is the honest result of a source-code search, not a guarantee neither ever existed under a different name.

Related

• SSO, SCIM & LDAP — enterprise identity-provider login, which bypasses this page's password/MFA rules for SSO-authenticated users.
• Users & Roles