Sign-in and MFA
On the Sign-in page of the Admin App you choose how the users of your Tenant sign in. You need the Right to manage sign-in for it. Admins hold it.
Each setting is saved as soon as you change it. It applies from each user’s next sign-in, and at the latest after 15 minutes, when the apps renew their sign-in.
The settings
Section titled “The settings”| Setting | What it does |
|---|---|
| Allow sign-in with a password | Users sign in with their email and a password. It stays on until your Tenant signs in with SSO, so that nobody is locked out. |
| Require two-step verification for password users | Everyone who signs in with a password also enters a code from an authenticator app. See below. |
| Allow passwords for users of other domains | Users whose email isn’t in one of your Verified Domains, such as guests and contractors, may keep signing in with a password. It takes effect once your Tenant signs in with SSO. |
Require two-step verification
Section titled “Require two-step verification”- In the Admin App, select Sign-in.
- Select Require two-step verification for password users.
Users who have already set up two-step verification notice nothing. Everyone else is asked to set it up at their next sign-in, before they can do anything else in your Tenant. If they belong to another Tenant that doesn’t require it, they land there instead and are asked to set it up when they switch to yours. That includes you: set it up for your own account first.
To stop requiring it, clear the same checkbox. Users keep two-step verification once they set it up, until they turn it off themselves.
What the Audit Log shows
Section titled “What the Audit Log shows”Every change of a setting leaves an entry in the Audit Log with the setting’s name, who changed it and when. It doesn’t record the value.