Set your organization's sign-in security

The Security tab holds the rules for how people get into Polzy, for every workspace on your organization at once. Everything here is enforced, not advice: a sign-in ends when its session length is up, an invitation outside your allowed domains is refused, and an admin who must use two-step verification can do nothing else until it is set up.

Open the Security tab

Open the account menu at the bottom of the sidebar, choose Organization settings, then Security. The tab has four groups, Sign-in, Access, Single sign-on and Recent sign-in activity, and the Security score beside them.

Session length

Session length is how long a sign-in lasts before people sign in again. Choose 8 hours, 24 hours, 3 days or 7 days.

• The length is counted from the moment someone signs in. Using Polzy does not stretch it.
• Shortening it applies straight away to people already signed in: a session older than the new length ends at their next step.
• The first option, 7 days (default), leaves the length to the sign-in page: a sign-in lasts 12 hours, or 30 days when the person ticks Keep me signed in for 30 days.

It is the same for every workspace on your organization. People who sign in through your single sign-on follow it too.

Require two-step verification for admins

Switch on Require two-step verification for admins, and every admin of your organization signs in with a code from an authenticator app on their phone. An admin who has not set it up is asked to before anything else.

1. First turn on two-step verification for yourself, from your profile. Polzy refuses the switch until you have: Turn on two-step verification for yourself (Account → Profile) before requiring it of every admin.
2. On the Security tab, switch on Require two-step verification for admins.

The rule covers people with the Admin role. Editors and Viewers can still turn two-step verification on for themselves. An admin who signs in through your organization's single sign-on is not asked for a Polzy code: your identity provider does that check. How to set up two-step verification and keep recovery codes: Sign in and two-step verification.

Allowed email domains

Under Access, Allowed email domains limits who can be invited as a member. Type a domain, such as acme.com, and choose Add; remove one with its cross.

• Members can then be invited only from addresses on these domains, and on their subdomains: acme.com also allows eu.acme.com.
• Up to 20 domains. With none, anyone can be invited.
• The rule applies to member invitations, from the Members page or anywhere else. Contacts, who never sign in, are not affected, and neither are people who arrive through single sign-on, SCIM or a people sync, which have rules of their own.

An address outside the list is refused with That address is outside your organization's allowed email domains, so it can't be invited. See Invite members.

Security score

The Security score beside the tab shows how well your sign-in is protected, out of 100, from four checks:

Each check met adds 25 points. The same four appear as recommendations in Set up with Polzy.

Recent sign-in activity

Recent sign-in activity lists the last eight members who signed in to the workspace you are in, with their role and when. It is a quick look, not a history: for every sign-in across your organization, with the address and browser, use the audit log on Enterprise, where each one is recorded as Signed in.

Single sign-on and SCIM

On the Enterprise plan, the Single sign-on group shows your organization's own sign-in: verified domains, the identity provider, whether single sign-on is required, IT setup links and SCIM provisioning. Admins see where each stands; the Owner sets them up. On other plans the rows show the plan they need.

• Set up single sign-on: sign in through Okta, Microsoft Entra ID, Google Workspace or another identity provider, and require it if you choose.
• Provision members with SCIM: let your directory add and remove members.

Good to know

• Who changes what. Any admin can change the session length, the two-step rule and the allowed domains. Each change is recorded in the audit log as Sign-in rules changed.
• One set of rules. The rules belong to the organization, so you see the same values from any of its workspaces.
• Sessions you see yourself. Everyone can see where they are signed in, and sign out everywhere, from their own profile.

Troubleshooting

• Turn on two-step verification for yourself (Account → Profile) before requiring it of every admin. Set it up for yourself first, then switch the rule on.
• People are signed out sooner than expected. Check the session length: it counts from signing in, and shortening it applies to sessions already open.
• That address is outside your organization's allowed email domains, so it can't be invited. Add the domain under Allowed email domains, or invite an address on a listed domain.
• Could not load the security settings. Choose Try again. Nothing is shown rather than a list that might be incomplete, so a domain added now cannot overwrite the ones that did not load.