Get early access
In this section (15)

Set workspace security policies

Choose password strength, session timeouts, which email domains can be invited and who must use two-step verification.

2 min read

Security policies set the sign-in rules for everyone on your team. They are available on every plan. Only admins can change them.

Open Admin Center, Security & compliance, Security policies, change what you need, then choose Save policy.

Password strength

LevelRule
Standard (default)At least 10 characters, not found in known data breaches
StrongAt least 12 characters, and three of: lower case, upper case, digits, symbols
StrictAt least 16 characters, and three of: lower case, upper case, digits, symbols

The level applies when a team member sets or changes a password. Existing passwords keep working. A password can never be the person’s own email address.

Sessions

  • Idle timeout: sign out after this many minutes without activity, from 5 to 480 (8 hours, the default).
  • Maximum session length: sign out this many hours after signing in, even when active, from 1 to 720 (30 days, the default). It can’t be shorter than the idle timeout.
  • Allow “Keep me signed in”: when on, remembered sessions stay signed in for up to 30 days of inactivity. When off, they time out like any other session.

The limits also apply to sessions that are already open. A session past a limit ends, and the person signs in again.

Invitations

Under Allowed email domains, list your company’s domains, one per line (up to 50). Admins can then only invite team members with an address on those domains. Leave it empty to allow any address.

Two-step verification

Tick Required for agents, Required for admins or both. People in those roles must set up an authenticator app or a passkey before they can use ChaosDesk. See Two-step verification and passkeys.

Other sign-in rules

These have their own pages:

Policy changes are recorded in the audit log.

Was this article helpful?