Security policy and single sign-on

The security tab

Each switch on Security applies to everyone at once:

• Require two-factor authentication: people set up an authenticator app at next sign-in. Do this first.
• Allow "Anyone with the link": when off, existing public links stop working immediately.
• Allow sharing with people outside the workspace with an optional Only these outside domains list.
• Allow self-service password reset: uses each person's recovery email.

Two-factor by person and Recovery email by person show who has set them up. Use Reset when someone loses their phone.

Do it: turn on two-factor

1. Open Security.
2. Switch on Require two-factor authentication.
3. Tell your team that they will be asked at next sign-in.
4. Come back a week later and check Two-factor by person.

Single sign-on

If your company manages accounts in an identity provider, use Single sign-on (part of the Business plan). Steps:

1. Verify your email domain under Domains first.
2. Add connection, choose OpenID Connect or SAML, and enter the company name and email domains.
3. In your provider create an application and copy details across: issuer, client ID and secret for OpenID Connect, or metadata for SAML. Copy the Redirect URI (or SAML ACS URL) from PGB Business into the provider.
4. Save, then Check settings and Test sign-in, then Turn on.

Requiring it safely

Require SSO takes effect at once. Add up to 3 break-glass administrators first: mailboxes that can still sign in with a password if the provider is down. At least one is needed, and their passwords and two-factor must be safe.

Read Set the workspace security policy and Single sign-on.

Recap

• Two-factor first.
• Test SSO before requiring it.
• Always keep break-glass administrators.