Session timeout and password policies

Choose how long people stay signed in, how strong passwords must be, who needs two-step verification and where staff may sign in from.

Before you begin

• A role with settings.security.configure, such as Administrator.
• Every change on this page asks you to confirm it’s you and is recorded in the audit log.

Set session timeouts and password rules

1. Go to Settings → Security and privacy and find Sign-in and sessions.
2. Choose the Web session timeout (15 minutes to 8 hours of inactivity; default 30 minutes).
3. Choose the Longest sign-in: 4, 8, 12 or 24 hours (default 12).
4. Choose the Support worker app timeout: 4, 12 or 24 hours of inactivity (default 12) for the support worker app.
5. Choose the Minimum password length: 12, 14, 16 or 20 characters (default 12).
6. Choose Slow down sign-in after: 3, 5 or 10 failed attempts (default 5).
7. Select Save changes at the top of the page and confirm it’s you. The policy applies from each person’s next sign-in.

Block passwords found in known data breaches is always on and can’t be switched off.

Require two-step verification

1. On the same page, find Two-step verification.
2. Switch on Require for all staff, or leave it off and tick Required for individual roles. Roles with sensitive permissions are always required.
3. Under Methods people may use, tick Authenticator app, Passkey, SMS code and/or Email code.
4. Select Save changes. A note lists who will be asked to set it up at their next sign-in.

Limit staff sign-in to your networks

1. Find the IP allow-list card and select Add range.
2. Enter the Address or range (for example 203.0.113.0/24) and a Label such as “Head office”.
3. Under Applies to, leave every role unticked to cover all staff (except the support worker app), or tick the roles it applies to. Select Add range.
4. Check that Your address shows On the list. If not, select Add it.
5. Switch on Enforce the allow-list.

You can’t enforce the list, or remove a range, if that would block your own address. Family and external users aren’t affected.

Tips

• Pick a web timeout your staff can live with. Very short timeouts on shared office PCs lead to people writing passwords down.
• To sign one person out now, use End sessions on their user record. See Creating and managing user accounts.
• Passkeys are the strongest method and the easiest for staff once set up.

If something goes wrong

Save changes stays disabled

Nothing has changed, or your role lacks settings.security.configure (the fields are greyed out).

A role’s Required box can’t be unticked

The role has sensitive permissions, so two-step verification is always required for it.

The allow-list won’t switch on

Your own address isn’t on the list. Use Add it next to Your address, then try again.

Staff say they’re signed out too often

Check the Web session timeout and Longest sign-in. Changes apply at their next sign-in.