Security settings: passwords, sessions and IP limits
Set password rules, sign people out after inactivity, and limit sign-in to your networks.
Before you start
Go to Settings → Security. You need the Manage security settings permission. Administrators have it.
Password rules
- Password strength requirements — set a minimum length (at least 8) and whether passwords need an uppercase letter, lowercase letter, number or special character. When this is off, passwords only need 8 characters.
- Force new password — make everyone choose a new password every 14, 30, 90 or 180 days. When this is off, passwords don't expire.
New rules apply the next time someone sets a password.
Session timeout
Under Sessions & Audit Log → Session Timeout, choose how long someone can be inactive before they're signed out: 30 minutes, or 1, 4, 8 or 12 hours. The default is 12 hours.
Audit log
Keep Audit Log on to record who changed what, and when. See Use the audit log.
Limit sign-in to your networks
Under IP Restrictions, click Use my IP. This adds the address you're on now, so you can't lock yourself out.
Enter an address (such as 203.0.113.10) or a range (such as 203.0.113.0/24). Add a label such as Office. You can add up to 50.
Save the list. From now on, only listed addresses can sign in.
When the list is empty, people can sign in from anywhere.
Good to know: home and mobile internet addresses often change. People working remotely may need a wider range or a VPN.
Someone on an address that isn't listed sees Access restricted, with their address. An administrator can add it, or they can connect from an approved network.