Security
Password policy, lockout, session timeout, 2FA, magic-link login, and SSO enforcement.
Overview
Security settings control password rules, login lockout, session timeout, two-factor requirements, magic-link login, and which roles must use SSO.
Where it lives
Route: /admin/settings/security (admin.settings.security)
Open Admin → Users & Security → Security. Requires settings.manage.
Key settings
| Section | Settings |
|---|---|
| Password policy | Min length; require uppercase / number / special |
| Login security | Max attempts; lockout duration (minutes) |
| Session | Timeout (minutes) |
| 2FA | Require for admins; require for all users |
| Passwordless | Magic-link login toggle |
| SSO enforcement | Role checkboxes (excludes Owner) |
Validation rules come from the security group in SettingsRegistry. Save shows an inline confirmation (no full reload).
Related
- API Tokens
- Integrations — SSO provider credentials