Single sign-on with OIDC or SAML
Connections people reach by their email domain. A first sign-in can create the account with a default role, within your seats. Password sign-in stays available.
How it works: Single sign-on with OIDC or SAMLSecurity & identity
Who gets in,
and what they can touch.
Connect your identity provider, decide who sees which people and devices, and keep a record of every sensitive change. Each control below is a setting your administrators use; the security page covers how we run the service.
What it does
Security & identity, in detail
SCIM directory provisioning
Your identity provider creates, updates and switches off accounts through a SCIM 2.0 endpoint and a company token. Removing someone frees their seat.
How it works: SCIM directory provisioningRoles, company roles and scopes
Built-in roles or company roles with the permissions you pick, plus per-person grants. Each sees only its scope: company, department, branch, team or reporting line.
How it works: Roles, company roles and scopesTwo-step sign-in you can require
Require an authenticator-app code for administrators or for everyone. Each person gets ten one-time recovery codes, and an administrator can reset a lost phone.
How it works: Two-step sign-in you can requireNetwork and sign-in hour rules
Keep the console to listed IP addresses, to chosen days and hours, or each branch to its office networks. Hours are checked on every request.
How it works: Network and sign-in hour rulesPassword rules and session limits
Stricter password length, expiry, reuse and lockout rules, idle sign-out, devices per person and how long a sign-in lasts. People can end their own sessions.
How it works: Password rules and session limitsApproval for new sign-in devices
Record the browsers people sign in from, flag new ones, or hold a new device until an administrator approves it. Blocking a device signs it out at once.
A second admin for sensitive access
With approvals on, a change that adds sensitive access waits for another administrator and runs as them. You choose what counts as sensitive; removals never wait.
How it works: A second admin for sensitive accessA searchable audit log
Sign-ins, refused sign-ins and changes to roles, settings and SSO, with who, when and from which address. Filter by action, person and date.
How it works: A searchable audit logAccess reviews on a schedule
Review everyone, administrators or people with sensitive access. Their manager keeps or removes each person's access with a note, and nothing goes without a decision.
How it works: Access reviews on a scheduleGetting started
Up and running in three steps
- Set sign-in rulesChoose who must use two-step sign-in, tighten the password policy, and set session limits and allowed networks.
- Connect your directoryAdd an OIDC or SAML connection for your email domains, then a SCIM token if your directory should manage accounts.
- Review who can do whatAssign roles, switch on second-admin approval, and start an access review in the Access center.
Try security & identity on your own setup
Start a free trial, or book a demo and we will walk you through it.