Security settings · BreezeAuth Docs

The Security settings tab of Organization holds the rules that protect every account in your organization. Each group of settings has its own Save changes button, which appears as soon as you change something in that group.

Changing these settings requires the Owner or Administrator role. Other roles can view them.

Who each setting applies to

Some settings can only apply to the accounts your organization controls: its managed users. Others apply to everyone who uses the organization.

Setting	Managed users	Guests	Service users
Session duration	Yes	No	No
Mandatory MFA	Yes	Yes	No
Password policy and expiry	Yes	No	No
Network and country restrictions	Yes, also at sign-in	Yes, when using your organization	Yes

Session settings

A session starts when someone signs in to BreezeAuth on a device. These two limits decide when they must sign in again:

Setting	What it does	Default
Maximum idle session duration	Ends a session after this many hours without activity.	12 hours
Reauthentication interval	Ends a session this many hours after sign-in, even if the person is active, so they sign in again.	24 hours

Both accept values from 1 to 168 hours (one week). The idle duration can’t be longer than the reauthentication interval.

Shorter values are safer, especially on shared devices, but make people sign in more often. For most companies, an idle duration of a few hours and a reauthentication interval of one working day are a good balance.

Require MFA

Multi-factor authentication (MFA) asks for a second proof besides the password, such as a code from an authenticator app. It stops most attacks that rely on stolen passwords.

To require it, turn on Mandatory MFA under Authentication settings and select Save changes. From then on:

Managed users without MFA are asked to set it up when they sign in, before they can continue. They can’t remove their own MFA while it is mandatory. An administrator can still remove it for them, for example after they lose their phone, and they set it up again at their next sign-in.
Guests without MFA can’t use your organization, or sign in to its applications, until they set it up in their account.
Service users are not affected: they authenticate with credentials.

Tip: check the MFA adoption figure on the Manage Organization page before turning it on, and tell people in advance. Those who already set up MFA won’t notice anything.

Password policy

The Password policy applies to managed users whenever they choose a password: at their first sign-in, when they change it, and when an administrator sets an initial password. Guests’ passwords are governed by BreezeAuth’s own rules, not by your policy.

Option	Default
Prevent the use of previously used passwords	On
Prevent the use of passwords found in known data breaches	On
Require special characters	On
Require uppercase and lowercase letters	On
Require numbers	On
Minimum number of characters	12
Expire the password after	Never expire

Whatever the policy, a password can never contain the person’s first name, last name or the part of their e-mail before the @.

Breached passwords are checked against a database of passwords exposed in public data leaks. A password that appears there is refused, even if it meets every other rule.

Password expiry

With Expire the password after set to 30, 90, 180 or 365 days, managed users must choose a new password once that many days have passed since their last change, or since their account was created if they never changed it. They are asked at their next sign-in.

Expiry counts from past changes too: if you choose 90 days, everyone whose password is already older than 90 days must change it the next time they sign in.

Note: forcing regular password changes tends to make people pick weaker, predictable passwords. Long, unique passwords combined with mandatory MFA protect better. If your company requires expiry, 180 days is the recommended value.

Policy changes apply to the next password each person chooses. Existing passwords keep working: to make everyone choose a new password that follows the new policy, use Force a password change on the next authentication.

Restrict access by network

Under Network access restriction settings, you can allow access to the organization only from the network zones you select, such as your offices and VPN. The setup, and the precautions to avoid locking yourself out, are described in Restrict access to the organization.

Restrict access by country

Under Geolocation access restriction settings, Restrict access by country limits access to the organization based on the country of the connection’s IP address.

Option	Effect
No restriction	The default. Access is allowed from any country.
Allow only selected countries	Access is allowed only from the Allowed countries.
Block selected countries	Access is refused from the Blocked countries.

In Restrict access by country, choose Allow only selected countries or Block selected countries.
Read the Confirm country access restriction dialog and confirm with I understand the risks.
Type the country codes, pressing Enter after each one. Use two-letter ISO 3166-1 codes, such as BR for Brazil, US for the United States or PT for Portugal.
Select Save changes.

The restriction applies to every member of the organization, including service users. Managed users also can’t sign in to BreezeAuth from outside the allowed countries.

Warning: the restriction applies to you too, as soon as you save. With Allow only selected countries, make sure the country you are connecting from is on the list. Remember people who travel, and integrations whose servers run in another country, such as cloud services hosted in the United States.

Country detection relies on IP address databases, which are accurate for most connections but not all. People connecting through a VPN appear to be in the VPN server’s country.

To lift the restriction, choose No restriction and select Save changes.

Changes are audited

Every change on this tab is recorded in the Audit Logs as Organization updated, with who made it and which settings changed.