Password Policy and Sign-In Protection

This page is for administrators. It covers the password rules you set for the organization in Settings > General, the protection against password guessing that is always on, and the session duration. The screens an employee sees while these rules apply are described in Signing In and Out.

Password policy

The password policy has three fields in Settings > General. Saving them needs the permission to update organization settings.

The password policy sets a minimum length, a number of recent passwords that cannot be reused, and a password lifetime:

  • Password policy: minimum length (characters) defaults to 6 and accepts 6 to 128.

  • Password policy: passwords that cannot be reused defaults to 5 and accepts 1 to 24. The count includes the current password.

  • Password policy: password lifetime (days) accepts 1 to 3650 days. Left empty, which is the default, passwords never expire.

A new password is checked in this order:

  1. It is not blank.

  2. It has at least the minimum length.

  3. It does not start with csd_app_, which is reserved for app passwords.

  4. It differs from the current password and from the recent ones. This check applies only when an account that already has a password sets a new one.

The policy applies wherever a password is set:

  • an employee changing their own password on the account page;

  • an employee setting a new password with a reset link;

  • an employee choosing a new password when the old one has expired;

  • an administrator giving a new employee an initial password.

Existing passwords are not checked again when you raise the minimum length. The new minimum applies the next time each password is set.

The policy checks the length and the reuse of a password and accepts any characters.

Password expiry

When a password lifetime is set, a password expires that many days after the moment it was set. A lifetime that you shorten later applies to passwords already set, so a password older than the new lifetime expires at once.

When a password expires:

  • open sessions of the account stop working at once, and connected applications are told that the employee signed out;

  • the next sign-in on the web or on the OAuth sign-in page asks for a new password;

  • sign-in over LDAP with that password is refused like a wrong password.

Personal access tokens, OAuth tokens and app passwords keep working after the password has expired.

At the next sign-in the employee enters the old password and chooses a new one, as described in Signing In and Out. A mail client that signs in over LDAP with an app password is unaffected, as described in Access Tokens and App Passwords.

Employees see the date in Password expires on the account page, under Profile. No e-mail is sent before that date.

Blocking repeated failed sign-ins

Every sign-in path counts failed attempts and blocks guessing. This protection is always on, and an administrator has nothing to configure.

After several failed sign-in attempts with one login from one address, sign-in with that login from that address is blocked for a few minutes, and the block grows longer while the failures continue. A block ends by itself, so nobody has to unlock the account, and the sign-in log records each block. The account itself is never locked.

During a block each caller sees an ordinary refusal:

Caller What it sees

Web sign-in

"Too many attempts. Try again in N min." The Log in button stays disabled until the wait ends.

LDAP client

The answer for a wrong password.

OAuth client

An error for a wrong client or grant, with a Retry-After header.

Every block is written to the sign-in log as Sign-in blocked, with Blocked for N min.

Session duration

User session duration in Settings > General sets how many days a sign-in session lasts. The default is 3 days, and valid values range from 1 to 100.

The duration is absolute. A session ends that many days after sign-in, however active the employee has been. Changing the setting also moves the end of sessions that are already open.

A session that ends because its duration is over does not notify connected applications. See Sign-out across applications for the events that do.

Always on

Web sign-in, sessions, password change and reset, two-step verification, the attempt limit and the sign-in log are part of every organization. No license is needed for them, and no setting turns them off. The two-step verification policy decides whom the organization requires to use two-step verification.

Related pages