Sign-in rules

Owners and Admins set how members sign in to the organization. The rules apply to every member, including the Owner.

Before you start

• You need the Owner or Admin role in the organization.
• Turn on two-step verification on your own account first if you plan to require it. See Account security.

Allow sign-in methods

1. Open Organization settings and click Authentication.
2. Under Allowed sign-in methods, tick the methods members may use: Email + password, Google, Facebook.
3. Click Save policy.

Keep at least one method ticked. Company SSO shows in the list only when SSO is set up for the organization.

A member who signs in another way sees Your organization does not accept the way you signed in. They must sign out and sign in again with an allowed method.

Require two-step verification

1. Open Organization settings and click Authentication.
2. Under Require two-step verification, pick:
   • Off: nobody has to use it.
   • Admins only: the Owner and Admins must use it.
   • Everyone: every member must use it.
3. Set the Grace period (days): from 1 to 30. The default is 7.
4. Click Save policy.

During the grace period, members without two-step verification see a banner: Your organization requires two-step verification. N days left. They click Set up now to turn it on.

After the grace period, they cannot open the organization until they turn it on.

Tip

The header of Organization settings shows how many members already use two-step verification. Check it before you shorten the grace period.

Single sign-on (SSO)

SSO is coming soon for the Enterprise plan. The SSO tab shows the planned settings, but you cannot use them yet. On Free and Pro the tab says SSO is part of the Enterprise plan.

Notes

• Fresco BI refuses a policy that would lock you or the Owner out. For example, you cannot remove the method you signed in with, or require two-step verification for yourself before you turn it on.
• A stricter two-step rule starts a new grace period.
• Every change is written to the Activity log.
• If a member lost their second step, an Admin can reset it. See Members and roles.

Questions

Why was my policy refused? It would lock you or the Owner out. Sign in with a method you keep allowed, and turn on two-step verification first.

Does the grace period restart when I save again? Only when the rule becomes stricter, for example from Admins only to Everyone.