In this lesson you
- Saw how to require two-factor sign-in
- Limited invitations to your own email domain
- Found single sign-on and session length
Transcript
Who can get in
Security settings. Anyone who can sign in to your workspace can see your documents, and change them. So who can get in, and how sure are you that it's really them? The Security page in Admin sets that. It decides who can join, how people prove who they are, and how long a sign-in lasts.
Two-factor sign-in
Let's start with proving who someone is. A password on its own can be guessed or stolen. Two-factor sign-in adds a short code from an authenticator app on the person's phone. To make that the rule for everyone, turn on Require two-factor authentication. Anyone not yet set up is sent to enroll on their next visit. While it's off, as here, each member decides for themselves. Once it's on, the line under the switch counts who still hasn't enrolled.
Who can be invited
Next, who can be invited at all. A mistyped or personal address is the easiest way in for the wrong person. Allowed email domains closes that gap. A domain is the part of an email address after the at sign. Add yours, here maple-ridge.test, and invitations can only go to addresses on it. List any subdomains separately.
Single sign-on
Many organizations manage staff accounts in one place, such as Microsoft Entra ID or Okta. That's called an identity provider. Single sign-on lets your people sign in to Proof with that same work account. Close someone's work account, and they can no longer sign in here through it. Proof never holds their password, and never sees their second factor. To connect one, copy the Redirect URI and register it with your provider. Then add the connection below, with the details your provider gives you. It starts switched off, so turn it on once the provider is ready. If your provider already asks for a second factor, turn on Our provider already requires MFA. MFA means the same as two-factor. People who sign in through it aren't asked twice.
Who a sign-in becomes
A connection proves who someone is. It doesn't say what they may do in Proof. The rules under Who a federated sign-in becomes decide that. Each rule matches people by their email domain, or by a group your provider sends. Under Put them in, choose a team, which decides the documents they reach. Under As, choose their role. Rules run in order, and the first match sets the role. Someone no rule matches is refused. So add a rule before you turn a connection on.
Joining without an invitation
You may not want to invite everyone one by one. Claimed domains lets anyone from your domain join as a member the first time they sign in with Google. Sign-in through your own identity provider still follows the rules above. First you prove you own the domain. Choose Claim, have your IT team add the record it shows, and choose Check DNS. Then turn on Auto-join.
How long a sign-in lasts
A computer left signed in is an open door. Session lifetime sets how many hours a sign-in lasts, even if the person is still working. Leave it empty, as here, and members are signed out after eight hours without activity. However active they are, they're signed out twelve hours after they signed in.
Passwords
For people who use a password, Password policy sets how strong it must be. The minimum is fourteen characters. You can raise it, and require a number or a symbol.
Your documents and model training
Last, a question your legal team may ask. Are our documents used to train AI? Model training on your documents answers it. It's off unless an administrator turns it on, and it can be turned off at any time. Every change on this page is recorded in the activity log, which has its own lesson. Now you can decide who gets into your workspace, how they prove it's them, and how long they stay signed in.
Recap
That's the end of this lesson.
Maple Ridge Community Health, its documents and its people are fictional, made for these lessons.