Login security and MFA

Set up sign-in methods, recovery options and the policies that apply to user accounts.

Needs: Pro · Security

Administrators use the Security workspace's Overview, People, Activity and Lockouts & bans screens to manage login protection. Users manage their own methods through My security. A client or employee record may also provide Login Security controls for the linked account.

Enroll a sign-in method

Supported methods include device or password-manager passkeys, FIDO2 security keys, authenticator codes, email fallback and backup codes. Open My security, follow the enrollment prompts and complete any confirmation requested by the device or key.

Give each method a recognizable name and keep a recovery option that meets the site's policy. Store backup codes securely outside ordinary CRM notes. Review trusted devices and sessions periodically and revoke those you no longer use.

Configure a role policy

Administrators can choose whether a role needs no additional factor, an accepted second factor or a passkey. The available settings also include grace days and the trusted-device period. Setting the trusted duration to 0 disables that trust period.

Passwordless login is a separate choice. Test the intended policy with the role and browser that will use it, and make sure affected people have an enrollment and recovery route before enforcing it.

Check device and hostname requirements

Passkeys require a valid HTTPS origin, the correct relying-party hostname and a supported browser or device. A passkey used on production may not apply to staging or another hostname. Enrollment also requires the person's own device interaction; an existing signed-in session does not enroll a new method by itself.

For rejected authenticator codes, check the device time and the enrolled account. For a lost method or lockout, follow account recovery.