Set the security policy

The security policy applies to everyone in your organization: whether they must confirm their identity with a second factor when they sign in, which methods they may use for that, and how long they stay signed in.

Where

Settings › Organization Settings › Security

Who

Organization administrator

The page has a card for each part. Each card has its own Save and Discard; saving one card does not save the other.

Ticking Require MFA makes the card’s Save available. The session card below keeps its own Save and Discard.

Require multi-factor authentication

1. Select the gear () at the bottom of the left navigation, then select Security.

2. In Multi-Factor Authentication, check Require MFA. Allowed MFA methods appears.

3. Check the methods users may use: Email OTP, Authenticator app, or both.

4. Select Save in the same card.

Result: the message Security settings updated successfully appears. From their next sign-in, every user must enter a verification code after their password.

Method	How it works	Trade-off
Email OTP	A one-time code is sent to the user’s email address.	Nothing to install, but only as strong as the mailbox: anyone who can read the user’s email can sign in with their password.
Authenticator app	The user reads a code from an app on their phone, such as Microsoft Authenticator.	Stronger and works without email, but each user has to set up the app once, and needs their phone (or a recovery code) to sign in.

Allowing both lets each user choose. At least one method must stay checked while MFA is required.

Caution

If you allow Authenticator app only, users who have not set one up yet are asked to do so at their next sign-in, before they can continue. Tell them beforehand.

When Require MFA is off, users are not forced to use a second factor, but can set up an authenticator app on their Profile. Every sign-in then asks them for its code. See Set up your account.

Set session timeouts

1. In Session Timeout Settings, choose the Idle timeout and the Maximum session duration (see the table below).

2. Select Save in the same card.

Field	What it does	Options
Idle timeout	A user who does nothing for this long is signed out.	1 hour, 2 hours, 4 hours, 8 hours or 24 hours. A new organization starts at 2 hours.
Maximum session duration	A user is signed out after this long, however active they are.	4 hours, 8 hours, 24 hours, 3 days or 7 days. A new organization starts at 24 hours.

The idle timeout cannot be longer than the maximum session duration.

Result: the message Security settings updated successfully appears.

Note

Someone who belongs to more than one organization gets the strictest policy of all of them: MFA if any of their organizations requires it, only the methods every organization allows, and the shortest timeouts.

Service provider access

If Cytometa has assigned your organization a service provider, a third card, Service Provider Access, appears on this page. See Allow service provider access.

If it does not work

Message	What to do
At least one MFA method must be allowed when MFA is required	Check Email OTP, Authenticator app, or both.
Idle timeout cannot exceed maximum session duration	Choose a shorter idle timeout or a longer maximum.
Save stays disabled	Nothing has changed in that card, or a message above it needs fixing first.

Related

• Sign in — what users see when MFA is on
• Set up your account — two-step verification and recovery codes
• Invite and manage users
• Limits and rules