Security
Two organization-wide controls: who must use multi-factor authentication, and how long a session stays valid.
Multi-factor authentication
The MFA policy has three modes:
| Mode | Effect |
|---|---|
| Optional | Users may enable MFA themselves. Nothing is enforced. |
| Required for everyone | Every member of the organization must set up MFA. |
| Required for specific seats | Only members of the seats you select must set it up. |
Enforcement happens at sign-in: a user covered by the policy who has not yet set up MFA must complete setup before they can get in. Turning the policy on therefore interrupts people mid-workflow the next time they authenticate — roll it out deliberately.
Choosing Required for specific seats with no seat selected is rejected: pick at least one seat, or choose a different mode.
Session management
Session duration sets how long before a user is forced to sign in again. The options range from 15 minutes to 24 hours, plus Never expires. One option is marked Recommended — that is the platform's default guidance, not a constraint.
Enforce single session per user terminates all but a user's most recently active session. Turning it on signs people out of their other devices the moment they sign in somewhere new. It is the right setting for shared or high-assurance environments and an annoyance everywhere else.
Where authentication itself is configured
This page governs policy. The identity provider people actually sign in through is configured under Single Sign-On, and what they can do once inside is decided by seats and permissions.