Configure authentication settings

Authentication settings control how users prove their identity when logging in. They live in the Two Factor Authentication and Login Policy sections of the policy form.

Two-factor authentication

Tick Enable two factor authentication to require a second verification factor for users assigned to this policy. Enabling it reveals these options:

• Token expiration duration: how long a verification token stays valid (for example, 10 minutes).
• Limit number of attempts: cap how many times a user can enter the second factor before the account is locked.
• Lock account indefinitely after max attempts: keep the account locked until an admin intervenes. When off, set an Account lock duration (for example, 1 hour) after which the account unlocks automatically.
• Warn before account lock: notify the user before their account is locked.

Login policy

In the Login Policy section:

• Limit number of login attempts: restrict how many times a user can fail to log in before being blocked.
• Prevent multiple sessions: stop the same account from being signed in from more than one session at a time.