> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.kodelabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Settings

> Configure MFA, password policies, and session timeouts

Security settings give administrators control over authentication, password policies, and session behavior. All configuration lives under `Security Settings`.

## Configuration

Authentication & Security covers three areas—MFA, Password, and Timeout Settings. Each area groups related controls that you can configure independently.

<Tabs>
  <Tab title="MFA">
    Multi-factor authentication (MFA) adds a second layer of verification beyond a password. You can choose whether to enforce MFA for your organization and configure how frequently users verify their identity.

    ### Enforcement

    <ParamField path="Don't enforce" type="Option">
      MFA is optional for all users.
    </ParamField>

    <ParamField path="Enforce for Email & Password users" type="Option">
      Requires MFA for all users who sign in with an email address and password. SSO users follow their identity provider's MFA policies.
    </ParamField>

    ### Frequency Options

    Select which frequency options are available to users. Users choose how often they're prompted for MFA during login based on the options you enable.

    <ParamField path="Every login" type="Toggle">
      Users verify their identity on every login. Highest level of security.
    </ParamField>

    <ParamField path="Remember 7 days on known device" type="Toggle">
      Users aren't prompted for MFA again for 7 days on a recognized device.
    </ParamField>

    <ParamField path="Remember 30 days on known device" type="Toggle">
      Users aren't prompted for MFA again for 30 days on a recognized device.
    </ParamField>
  </Tab>

  <Tab title="Password">
    Password settings let you define complexity requirements, configure lockout behavior after failed login attempts, and set additional password management rules.

    ### Password Complexity

    <ParamField path="Medium" type="Option">
      Passwords must be at least 8 characters and include 1 digit, 1 uppercase letter, and 1 special character.
    </ParamField>

    <ParamField path="High" type="Option">
      Enforces stricter requirements beyond medium, increasing resistance to brute-force attacks.
    </ParamField>

    <ParamField path="Custom" type="Option">
      Define your own complexity rules to match your organization's security policies.
    </ParamField>

    ### Lockout Settings

    <ParamField path="Lockout time" type="Field">
      How long an account stays locked after reaching the maximum failed login attempts. Defaults to `1`.
    </ParamField>

    <ParamField path="Lockout unit" type="Field">
      The unit of time for the lockout duration. Defaults to `Hours`.
    </ParamField>

    <ParamField path="Retries before lockout" type="Field">
      The number of failed login attempts allowed before the account locks. Defaults to `3`.
    </ParamField>

    ### Password Configuration

    <ParamField path="Password history" type="Toggle">
      When enabled, users can't reuse recent passwords.
    </ParamField>

    <ParamField path="Password expire time" type="Toggle">
      When enabled, passwords expire after a set number of days. Defaults to `90` days.
    </ParamField>
  </Tab>

  <Tab title="Timeout Settings">
    Timeout settings control how long user sessions remain active before requiring sign-in again.

    <ParamField path="Session Timeout" type="Field">
      How long a session can stay active before the user is automatically signed out. Defaults to `14` days.
    </ParamField>

    <ParamField path="Idle Timeout" type="Field">
      How long a session can stay idle before it's automatically terminated. Defaults to `1` day.
    </ParamField>
  </Tab>
</Tabs>