Sign-in security

Use this page to set the sign-in rules for everyone in your DataMind OS: password strength, account lockout, two-factor authentication (2FA) and idle logout. You set all of them in Admin > System Configuration > Security, and the Global 2FA and Idle Logout switches ask you to confirm each change before it applies.

Open the Security tab

Open Admin in the sidebar.
Select System Configuration at the top of the page.
Select Security.

Note

The Security tab appears if you have the System Settings Viewer or Password Policy Viewer permission. With only Password Policy Viewer, the tab shows the password policy and the allowed hosts list, and nothing else. The connector secret setting and the allowed hosts list are described in Scheduler, health, maps and connector safety.

Set the password policy

Password Policy sets the rules for every password on the platform. Rules apply from the moment you save them, and every password form picks them up straight away.

Under Length, enter Minimum length. It must be at least 1. To cap how long passwords may be, switch on Maximum length and enter the limit.
Under Character requirements, switch on each rule you want: Uppercase letter, Lowercase letter, Number or Symbol.
Under Rotation & reuse, switch on Password expiry to force a change once a password is older than the days you set, and Password history to block reuse of recent passwords.
Under Account lockout, switch on Lock accounts after failed sign-ins to set your own Failed attempts and Lockout duration.
Click Save. The message "Password policy updated." confirms the change. If the save fails, the panel shows "Failed to update password policy".

When you switch a rule on, its field fills with a suggested value: 64 for Maximum length, 90 days for Password expiry, 5 for Password history, 5 for Failed attempts and 15 minutes for Lockout duration. Change any of them before you save.

Revert and Save appear once you change a value. Save stays off while a field holds an invalid value, and the field shows what is allowed: "Enter a whole number of at least 1." for the lengths, "Enter a whole number of days, at least 1." for Password expiry, "Enter a whole number between 1 and 10." for Failed attempts, "Enter a whole number between 1 and 1440." for Lockout duration, and "Enter a whole number between 1 and 24." for Password history. If the maximum sits below the minimum, you see "Minimum length cannot be greater than maximum length."

Complexity rules apply to every password set or changed after you save. Existing passwords are not checked until their owner changes one, so use Password expiry to make people change theirs.

Each wrong password counts towards the lockout limit. One attempt before the lock, sign-in says "Invalid email or password. One more failed attempt will lock your account." When the limit is reached, the account stays locked for the Lockout duration, and sign-in is refused with "Account is temporarily locked due to multiple failed login attempts". At the 2FA step, the lock message reads "Account is temporarily locked due to multiple failed attempts". A successful sign-in clears the failed-attempt count. To unlock an account sooner, or to reset its password, which also clears the lock, use Passwords, locks and limits for a user.

Require two-factor authentication

Global 2FA controls how two-factor authentication is enforced for everyone.

Switch the toggle on, then click Confirm in Set Global 2FA to Optional.
To require 2FA for every user, click Required under Enforcement level, then click Confirm in Require Global 2FA.
To go back to optional, click Optional under Enforcement level, then confirm.
To turn 2FA off, switch the toggle off, then confirm Disable Global 2FA.

Mode	Who must set up 2FA	Status line
Disabled	Nobody	Disabled - 2FA is off for every user
Optional	Admins, users who can reset 2FA for others, and users you flag individually	Enabled - optional, enforced for admins and flagged users
Required	Every user	Enabled - required for every user

When you switch to Optional or Required, users who must set up 2FA and have not set it up yet are signed out, and they set it up at their next sign-in. Users who already use 2FA stay signed in.
While the mode is Required, users cannot turn off their own 2FA, and you cannot remove the requirement from an individual user.

Warning

Turning off Global 2FA deletes every user's 2FA data, including their authenticator setup and recovery codes. People who are already signed in stay signed in. If you turn 2FA on again, every user must set it up again. The Disable Global 2FA dialog asks you to confirm before the change applies.

To set up 2FA for yourself, see Two-factor authentication.

Sign out idle users

Idle Logout signs people out after a period without activity. It is off by default. Companies that do not want forced sign-out can leave it off.

Switch the toggle on, then click Confirm in Enable idle logout?. The dialog reads Every user will be signed out automatically after <n> minutes of inactivity., with your number in place of <n>.
Set Idle timeout (minutes) to a whole number from 5 to 1440.
Click Save. The panel confirms with Idle logout enabled - users are signed out after <n> minutes of inactivity.
To switch it off, turn the toggle off and click Confirm in Disable idle logout?. The dialog reads "Sessions will no longer expire from inactivity for any user.", and the panel confirms with "Idle logout disabled."

The field accepts a whole number from 5 to 1440; anything else shows "Enter a whole number between 5 and 1440 minutes." and Save stays off.
People are signed out after the timeout passes with no activity. Activity means moving the mouse, clicking, pressing a key, scrolling, touching the screen or switching back to a tab.
A countdown warning appears one minute before the sign-out, and any activity resets it. Activity in any open tab keeps the session alive in all of them.
DataMind Oda is excluded from idle logout: the desktop app, the VS Code extension and Oda in Excel.
When an idle session makes its next request, the platform refuses it with "Session expired due to inactivity", and the person signs in again. See Sign in and sign out for what people see on the sign-in page.
If a save fails, the panel shows "Failed to update idle logout policy".

Settings and defaults

Setting	What it does	Allowed values	Default
Minimum length	The shortest password allowed.	1 or more characters	8
Maximum length	The longest password allowed.	When on, at least the minimum length	Off (64 when you switch it on)
Uppercase letter, Lowercase letter, Number, Symbol	Require at least one character of each kind that is switched on.	On or off	On
Password expiry	Forces a change once a password is older than this many days.	1 or more days	Off (90 when you switch it on)
Password history	Blocks reuse of this many previous passwords.	1 to 24	Off (5 when you switch it on)
Lock accounts after failed sign-ins	Lets you set your own Failed attempts and Lockout duration.	On or off	Off
Failed attempts	Wrong passwords in a row before the account locks.	1 to 10	5
Lockout duration	Minutes an account stays locked.	1 to 1440	15
Global 2FA	The platform-wide 2FA mode: Disabled, Optional or Required.	Disabled, Optional or Required	Disabled
Idle Logout	Signs people out after the idle timeout.	On or off	Off
Idle timeout (minutes)	Minutes of inactivity before the sign-out.	5 to 1440	30 until you save a value

Who can change these settings

Password Policy Viewer lets you see the password policy. Password Policy Manager lets you change it.
System Settings Viewer lets you see Global 2FA and Idle Logout. System Settings Manager lets you change them. Changing the Global 2FA mode also needs Manage Global 2FA.
The Security tab itself needs System Settings Viewer or Password Policy Viewer. Without a manager permission, the password policy fields are read-only, and the Global 2FA and Idle Logout switches are hidden.
To change what a role can do, see Roles and permissions and the permission reference. Sign-in through a company identity provider is set up on Single sign-on (SSO).

Questions, answered

Does a stricter policy force everyone to change their password now?

No. The new rules apply to passwords set or changed after you save. To force regular changes, switch on Password expiry.

What is the difference between Optional and Required?

Optional makes 2FA mandatory for admins, users who can reset 2FA for others, and users you flag individually. Required makes it mandatory for every user, and users cannot turn off their own 2FA while it is on.

What happens when someone reaches the failed-attempt limit?

The account stays locked for the Lockout duration, and sign-in is refused with "Account is temporarily locked due to multiple failed login attempts". A successful sign-in clears the failed-attempt count.

Does idle logout apply to DataMind Oda?

No. DataMind Oda is excluded from idle logout, in the desktop app, the VS Code extension and Oda in Excel. Every other sign-in check still applies to it.

Why is Save greyed out next to the idle timeout?

The value must be a whole number from 5 to 1440. Save also stays off until you change the value.

I changed the 2FA mode and got an error. Why?

Changing Global 2FA needs Manage Global 2FA as well as System Settings Manager. Ask an administrator to add the missing permission to your role.

How many previous passwords can I block?

Up to 24. Set Password history to a whole number from 1 to 24.

Why does the Security tab show only the password policy?

Your role can read the password policy but not system settings. With only password-policy access, the tab shows the password policy and the allowed hosts list, and nothing else. To see Global 2FA and Idle Logout, ask for a role that includes System Settings Viewer.