Sign-in security
Configure company MFA policy and recover individual accounts without sharing secrets.
Overview
Company policy can require multi-factor authentication for everyone, require it only for administrators, or disable it for the company. A policy change is a high-impact security decision and requires the acting administrator's current authenticator code.
Changing policy revokes active company sessions so the new requirement takes effect at the next sign-in. Disabling company MFA removes an important protection and should be time-bounded, approved and re-enabled after the access problem is resolved.
An administrator may reset an individual user's MFA enrollment when the user's authenticator is lost. The user enrolls a new authenticator at the next sign-in; the prior secret and recovery codes are invalidated.
Ordinary access tokens have a 30-minute inactivity boundary. The application renews a still-valid token only when the signed-in user is active, while every renewal rechecks the active company, named user and session version. Remember this device retains the separate 30-day lifetime. Closing a non-remembered browser session removes its token; disabling a user, changing a password, resetting MFA or changing company MFA policy continues to revoke the session server-side.