Set a security policy for your team

On Team, Team Plus and Enterprise. Only an Account Admin can change the policy.
  1. Step 1

    Set up your own second factor first

    Under Settings > Login Security, add an authenticator app or a passkey and create recovery codes. A policy that would lock you out cannot be saved.
  2. Step 2

    Choose the login methods

    Go to Settings > Security Policy. Under Login Methods Allowed, tick the methods users may use. Tick Require organization-administered accounts to block personal Google and Microsoft accounts. Users marked External User follow the External column.
  3. Step 3

    Require two-factor

    Under Two-Factor for Password Logins, tick Require two-factor and the accepted second factors: authenticator app, passkey or email code. Existing users have 7 days to set one up; new users set it up when they join.
  4. Step 4

    Choose a session length

    Under Session Length, choose how often users must log in again, then choose Save Policy. Users logged in with a method you turned off must log in again.
  5. Step 5

    Help a user who lost their second factor

    If the user has no recovery codes left, go to Settings > Team, choose Manage next to the user, then Issue Recovery Code. Give them the code in person, by phone or by chat, not by email. It works once, within 24 hours.

Features in this guide