Set workspace security policies

Security policies set the sign-in rules for everyone on your team. They are available on every plan. Only admins can change them.

Open Admin Center, Security & compliance, Security policies, change what you need, then choose Save policy.

Password strength

Level	Rule
Standard (default)	At least 10 characters, not found in known data breaches
Strong	At least 12 characters, and three of: lower case, upper case, digits, symbols
Strict	At least 16 characters, and three of: lower case, upper case, digits, symbols

The level applies when a team member sets or changes a password. Existing passwords keep working. A password can never be the person's own email address.

Sessions

• Idle timeout: sign out after this many minutes without activity, from 5 to 480 (8 hours, the default).
• Maximum session length: sign out this many hours after signing in, even when active, from 1 to 720 (30 days, the default). It can't be shorter than the idle timeout.
• Allow "Keep me signed in": when on, remembered sessions stay signed in for up to 30 days of inactivity. When off, they time out like any other session.

The limits also apply to sessions that are already open. A session past a limit ends, and the person signs in again.

Invitations

Under Allowed email domains, list your company's domains, one per line (up to 50). Admins can then only invite team members with an address on those domains. Leave it empty to allow any address.

Two-step verification

Tick Required for agents, Required for admins or both. People in those roles must set up an authenticator app or a passkey before they can use ChaosDesk. See Two-step verification and passkeys.

Other sign-in rules

These have their own pages:

• Restrict access by IP address (Enterprise)
• Set up OpenID Connect single sign-on and SAML single sign-on, each with an "SSO only" option

Policy changes are recorded in the audit log.

Related

• Security and privacy overview
• Add team members