Security

What's on this screen

• Six figures at the top: People with a second factor (with the share, verified TOTPs and recovery codes only under it), No second factor at all, People with a password, People with a linked provider, Live sessions, and the Oldest live session with the most recent last-seen time.
• Sign-in providers: whether each provider is configured in this environment, and how many people linked it; then what became of the sessions that ended.
• Security settings in force: the security keys and values in the platform's own record.
• The page is Security in the menu and follows the scope switcher: at an Account it shows that Account's posture (see that help); elsewhere the platform's.

How to read the numbers

• A second factor whose setup was started but not verified does not count as protection; it is listed separately.
• An expired session is not counted as live, even if its record does not say it was ended.
• A provider being configured means its client details are defined in this environment; those values are never shown anywhere. The value of a secret setting is not shown either.
• No default is made up for a setting with no recorded value; the list stays empty.

What cannot be changed here

Keep in mind MFA enforcement, password rules and session lifetime cannot be set from this screen. security.mfaMode and security.passwordPolicy are read, but the product has no path that writes them to the platform; session lifetime is not stored at all, it is a fixed default in the code. Nor can anyone else's session be ended from here — everyone closes their own sessions on the Active Sessions screen.

Narrower scopes can only tighten the platform's security values; a write that loosens them is refused when it is saved.

Who can see what

Opening the screen requires policy.read on the platform. The people counts also need membership.read; without that permission you see only the settings in force.