> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/security-policies.md).

# Security policies

Security Policies is where you set how users are allowed to identify themselves, how long a session survives without activity, whether bots are challenged at sign-in, and when an unused account is deactivated.

Four settings groups, one page, one **Save Changes** button.

## Opening the page

Select **Configuration** in the left navigation, then the **Security Policies** card.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/ZiPCZnQsxCvwViY66w1W/assets/01.png)

## Access methods

Access methods decide what a user may type into the first field on the sign-in page.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/HrIqY7ITMXL04wtSVyhk/assets/02.png)

| Access method | Enabled means                                         |
| ------------- | ----------------------------------------------------- |
| Username      | Users may sign in with their username                 |
| Email         | Users may sign in with their email address            |
| Mobile Number | Users may sign in with their registered mobile number |

Turn on any combination. The sign-in page changes to match — with all three enabled, it offers **Username or Email** in one field and **Mobile Number** as an alternative.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/jIEgAnSChZOK7vxuh3ow/assets/03.png)

{% hint style="info" %}
**Note**

Leave at least one method enabled. Turning all three off leaves no way to identify a user at sign-in.
{% endhint %}

## Session configuration

The idle session timeout is set separately for each portal. A user is signed out after this many minutes of inactivity, and the change applies at their next login rather than to sessions already running.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/slRNdYBnZGlMt04ESHmZ/assets/04.png)

| Portal              | Who it affects            |
| ------------------- | ------------------------- |
| Admin Portal        | The administrator console |
| Self Service Portal | End users                 |

The allowed range is **1 to 1440 minutes**. 1440 is a full day, which is rarely appropriate for the admin portal — administrators hold the most privilege and should time out soonest.

## Bot protection

Turning **Bot Protection** on enables CAPTCHA verification, so sign-in and form submissions have to prove a human is behind them.

This is the control that blunts automated attacks: fake account creation, spam submissions and credential brute-forcing.

## Dormant user settings

Dormant account handling deactivates accounts that stop being used, and warns the user before it happens.

| Setting                                                | What it does                                              |
| ------------------------------------------------------ | --------------------------------------------------------- |
| Remind user before deactivating his/her account for    | How many days of inactivity trigger a warning to the user |
| Deactivate user if not logged into any application for | How many days of inactivity deactivate the account        |

Set the reminder to fire before the deactivation, not after — the values in the screenshot, 363 and 365, give the user two days' notice.

{% hint style="info" %}
**Note**

Dormant accounts are one of the largest sources of unnecessary standing access in most estates. The dashboard reports the count under **User & Authentication**; if that number is large, this setting is why.
{% endhint %}

## Saving

Nothing on this page takes effect until you select **Save Changes**. All four sections save together.

## Where the rest of the security settings live

This page does not hold every security control. The remainder sit elsewhere under Configuration:

| Control                               | Where                                            |
| ------------------------------------- | ------------------------------------------------ |
| Password policy                       | Configuration → Authentication Modes             |
| Account lockout                       | Configuration → Authentication Modes             |
| IP, location, browser and OS blocking | Configuration → Blocked Settings                 |
| Duress policy and notification        | Configuration → Duress settings                  |
| Adaptive and risk-based rules         | *Authentication & MFA → Adaptive authentication* |
| Trusted and untrusted IP lists        | *Authentication & MFA → Adaptive authentication* |
| Device registration limits            | *Authentication & MFA → Adaptive authentication* |

Four settings, one save. The two worth arguing about are the admin portal timeout, which is usually set too long, and the dormant thresholds, which are usually set and forgotten.