> ## Documentation Index
> Fetch the complete documentation index at: https://help-empuls.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security settings

> Configure password policies, MFA, session timeouts, IP allowlists, and login attempt limits for your Empuls tenant.

Security settings give Super Admins the controls needed to meet enterprise security requirements: password policies (length, complexity, expiry, reuse), multi-factor authentication, session timeout, IP allowlists, and login attempt rate limits. Tighten or loosen each setting to match your organization's risk profile.

Open security settings from your **Admin Hub → Platform Settings → Security**. The URL is a sub-page; navigation breadcrumb only.

## Before you start

* You must be a **Super Admin**.
* Some settings (IP allowlist, MFA enforcement) can lock users out if misconfigured. Test with a small admin group before applying org-wide.
* Coordinate password policy with your [SSO setup](/admin/user-authentication/sso-overview). If SSO is the only login method, password policy applies only to fallback admin accounts.

## Password policy

| Setting                          | Default      | Recommended                                           |
| -------------------------------- | ------------ | ----------------------------------------------------- |
| Minimum length                   | 8 characters | 12+ for sensitive orgs                                |
| Require uppercase                | Off          | On                                                    |
| Require lowercase                | Off          | On                                                    |
| Require digit                    | Off          | On                                                    |
| Require special character        | Off          | On                                                    |
| Password expiry                  | 90 days      | 90 days for non-SSO accounts; off if SSO is mandatory |
| Password history (prevent reuse) | Last 5       | Last 12 for sensitive orgs                            |
| Force reset on first login       | On           | Keep on                                               |

Apply changes from the **Password Policy** card. Existing passwords stay valid until expiry; the new policy applies to the next reset and to new accounts.

## Multi-factor authentication (MFA)

Empuls supports MFA via:

* **TOTP authenticator app** (Google Authenticator, Authy, 1Password)
* **Email OTP** (one-time code to the registered email)
* **SMS OTP** (one-time code to the registered mobile number, where configured)

Configure MFA from the **MFA** card:

<Steps>
  <Step title="Choose required MFA methods">
    Pick one or more methods. Users will be prompted to set up at least one on next sign-in.
  </Step>

  <Step title="Choose enforcement scope">
    * **All users**
    * **Admin users only**
    * **Specific roles** — e.g., Super Admins and Finance Admins
  </Step>

  <Step title="Set grace period">
    New users have a grace period (default 7 days) to enroll. After that, they can't access Empuls without completing MFA setup.
  </Step>

  <Step title="Save">
    Enforcement begins immediately.
  </Step>
</Steps>

For SSO users, MFA is typically enforced at the identity-provider level (Azure AD, Okta, Google Workspace). Empuls's MFA applies to direct logins only.

## Session timeout

Set how long an idle session stays valid before the user must re-authenticate:

* **Web** — 8 hours default; common values 1h (high-security), 4h, 8h, 24h
* **Mobile** — 30 days default; common values 7d, 14d, 30d
* **MS Teams / Slack** — Inherits the host app's session

Active sessions are not affected; the new timeout applies to new sign-ins. Force-logout all sessions from the **Sessions** sub-tab if you need to push the change immediately.

## IP allowlist

Restrict Empuls access to specific IP ranges (typically your VPN egress IPs):

<Steps>
  <Step title="Toggle IP allowlist on">
    A warning banner reminds you that this can lock out users not on the allowlist.
  </Step>

  <Step title="Add CIDR ranges">
    Use `203.0.113.0/24` format. Add a description for each range.
  </Step>

  <Step title="Test from outside the allowlist">
    Try to access Empuls from a non-allowlisted IP (e.g., your mobile data) — you should be blocked.
  </Step>

  <Step title="Save">
    Enforcement is immediate.
  </Step>
</Steps>

Configure a **bypass list** for break-glass accounts — accounts that can sign in even when blocked by the allowlist. Keep this list short (1–2 Super Admin accounts).

## Login attempt limits

Empuls automatically locks accounts after repeated failed login attempts:

* **Threshold** — Default 5 failed attempts in 15 minutes
* **Lockout duration** — Default 30 minutes; admins can unlock manually
* **Notification** — Failed attempts above the threshold notify the user and the security admin

Adjust threshold and duration to match your security policy.

## Audit log

Every security-settings change creates an audit-log entry. View the log from the **Audit** sub-tab. Each entry includes the actor, the setting changed, the old and new values, and timestamp.

## Limits and gotchas

* Locking yourself out via IP allowlist is recoverable only via support — keep a bypass account.
* MFA enrollment is per-user; admins can't pre-enroll on behalf of users.
* Session timeout changes don't affect already-authenticated sessions until they expire naturally.
* Password policy changes apply only to direct-login accounts. SSO-only orgs see no effect.

## Related

<CardGroup cols={2}>
  <Card title="SSO overview" href="/admin/user-authentication/sso-overview">
    Federated identity that often supersedes Empuls password policy.
  </Card>

  <Card title="Access control" href="/admin/user-management/access-control">
    Pair with security settings for role-based hardening.
  </Card>

  <Card title="Manage employees" href="/admin/user-management/manage-employees">
    Unlock individual accounts when needed.
  </Card>
</CardGroup>