Security

On the Security screen the organization administrator sets the organization-wide multi-factor authentication (MFA) policy. It sits in the settings overview in the People & access group, beside users, teams and roles: MFA decides who gets into the organization.

How to set up MFA for your own account is described under Two-factor authentication.

Overview

Route	/organization/security
Audience	Practitioner (organization administrator)
Required permissions	security.view (view), security.manage (change the policy)

How it works

From an org-wide MFA policy to a per-user requirement

The MFA policy is an organization-wide setting, but it carries through to the individual user. When you enable MFA required for all users, every user must set up multi-factor authentication to keep access to the application.

The grace period softens that transition: for the configured number of days (minimum 1, maximum 90), users who do not yet have MFA can keep signing in and get time to set it up. Only after that period does the requirement become hard. The adoption statistics and the list of users without MFA show who still has to switch before the period expires.

Manage MFA policy

The Multi-factor authentication (MFA) card shows the current policy, the adoption statistics (how many users have set up MFA) and a list of users without MFA. Click Edit policy to change the policy, then save within the card. Changing it requires security.manage.

Field	Required	Description
MFA required for all users	No	When enabled, all users must set up MFA to access the application.
Grace period (days)	Yes, when required	The number of days users get to set up MFA after the requirement is enabled. Minimum 1 day, maximum 90 days.