---
title: Configure authentication settings
description: >-
  Configure two-factor authentication and login policy settings to control token
  expiration, attempt limits, account lockouts, and session restrictions.
lastUpdated: "2026-09-09"
---

> **For AI agents:** the complete documentation index is at [llms.txt](/llms.txt). Append `.md` to any page URL for its markdown version.

Authentication settings control how users prove their identity when logging in. They live in the **Two Factor Authentication** and **Login Policy** sections of the policy form.

## Two-factor authentication

Tick **Enable two factor authentication** to require a second verification factor for users assigned to this policy. Enabling it reveals these options:

- **Token expiration duration**: how long a verification token stays valid (for example, 10 minutes).
- **Limit number of attempts**: cap how many times a user can enter the second factor before the account is locked.
- **Lock account indefinitely after max attempts**: keep the account locked until an admin intervenes. When off, set an **Account lock duration** (for example, 1 hour) after which the account unlocks automatically.
- **Warn before account lock**: notify the user before their account is locked.

## Login policy

In the **Login Policy** section:

- **Limit number of login attempts**: restrict how many times a user can fail to log in before being blocked.
- **Prevent multiple sessions**: stop the same account from being signed in from more than one session at a time.