Sign-in and security settings

Open Manage → Security for personal sign-in settings. This page remains available even when your role has no access to other business resources.

Protect your own sign-in

Review whether two-factor authentication is available on the deployment, whether you are enrolled, and whether the organization requires it. Follow the enrollment flow and save the recovery codes when shown. Keep them somewhere you can access if you lose your authenticator. The summary shows how many codes remain.

An organization requirement can prevent disabling your second factor. Resetting another user’s MFA is a separate user-management permission, not a consequence of being able to change your own sign-in.

Organization policy

Organization security readers can inspect policy; changes require security:manage. Authorized administrators can manage the organization-wide two-factor requirement and identity provider settings. Availability depends on the deployment’s configured authentication services.

Review the provider configuration and default role before enforcing SSO. The default can be a custom role, and cannot be deleted while the SSO configuration references it. Members with security:manage retain password sign-in as a recovery path when SSO is enforced.

Access is determined by permissions, so an account named Admin does not necessarily have policy-management access. Use Users & roles to inspect the actual assignment.

Application credentials are managed separately under Secrets; AI provider credentials belong in AI & MCP.