Security
You see the security posture of the Account selected in the scope switcher, through this Account's people only.
Who is counted
The numbers cover this Account's people, not the whole platform: members of the Account's Tenants, and those with a role in the Account or in one of its Tenants. If nobody is linked to the Account, the section stays empty and fills with the first member or first role assignment.
The page is Security in the menu and follows the scope switcher: while an Account is selected it shows that Account; elsewhere it shows the whole platform.
What's on this screen
- Six figures at the top for this Account's people: who has a second factor (with the share, verified TOTPs and recovery codes only), who has none, who uses a password, who a provider, the live sessions and the oldest of them. Unverified setups are counted separately and do not count as protection; an expired session is not counted as live.
- Sign-in providers: each provider and how many of this Account's people linked it. Providers are configured at environment level; they cannot be switched on or off for an Account.
- Security settings in force: the value and label for each key.
Setting labels
| Label | Meaning |
|---|---|
| set in this account | The value is in this Account's own record. |
| comes from a parent scope | There is no record in the Account; the platform's value applies. When reading, the narrowest scope is checked first, then it moves up. |
| Platform floor | This Account can only tighten the setting; a write that loosens it is refused. |
Keep in mind MFA enforcement, password rules and session lifetime cannot be set here: the product has no action that writes to the Account scope, and session lifetime is not stored in any scope. Nobody else's session can be closed from this screen.
Who can see what
The screen requires policy.read in this Account, and the people counts also require membership.read. Secret values and credentials are never shown.