Sign-in rules and two-factor

Available onEvery plan

Who can do thisAnyone with an Infyva account

Every member can protect their own account with two-factor authentication. On Enterprise, owners and admins can also set sign-in rules for the whole workspace.

Turn on two-factor for your account

After your password, Infyva asks for a 6-digit code from an authenticator app.

1. In the sidebar, click Settings, then Sign-in rules.
2. Under Your two-factor authentication, click Set up two-factor.
3. Scan the code with your authenticator app. If you can't scan, type the Setup key into the app.
4. Enter the 6-digit Code from your app and click Turn on two-factor.
5. Save the 10 recovery codes somewhere safe, such as your password manager. Each one signs you in once if you lose your phone. They are not shown again.
6. Click I saved them.

After 5 wrong codes in a row, sign-in is locked for 15 minutes.

To get a fresh set of recovery codes, enter a Current code from your app and click New recovery codes. To turn two-factor off, enter a code and click Turn off two-factor. You can't turn it off when your workspace requires it.

If you sign in with single sign-on, your identity provider's two-factor applies instead.

Set sign-in rules for the workspace

Available onEnterprise

Who can do thisOwners and admins

These rules apply to everyone in your workspace.

1. Open Settings > Sign-in rules.
2. Under Workspace sign-in rules, set the rules you need (see below).
3. Click Save rules.

Rule	Choices
Require two-factor authentication	For Owners and admins or Everyone. People without two-factor are asked to set it up at their next sign-in, and their current sessions end within an hour. Turn on two-factor for your own account first.
Sign out after inactivity	Never (default), or from 15 minutes to 12 hours.
Sign in again after	No limit (default), or from 8 hours to 30 days.
Passwords	Minimum length from 8 to 64 characters (default 8), Upper and lower case letters, At least one number, At least one symbol and Block the most common passwords (on by default). Checked at sign-in; anyone whose password doesn't meet the rules is asked to reset it.
Approved networks	IP addresses or ranges, one per line, up to 100. Leave empty to allow any network. Your current address must be in the list.

Sign-ins through single sign-on use your identity provider's two-factor. See Single sign-on.

If your workspace moves off Enterprise, the rules are kept but not enforced.

Record an access review

Available onEnterprise

Who can do thisOwners and admins

An access review checks who can sign in to your workspace. Many security programs ask for one every quarter.

1. Open Settings > Sign-in rules.
2. Under Access review, click Download access review (CSV). It lists everyone with access, with their role, status, two-factor and last sign-in.
3. Check the list with your team, and remove or change anyone who shouldn't have access. See Roles and permissions.
4. Add Notes (optional), for example "Removed two contractors, confirmed admin list."
5. Click Mark review complete.

The page then shows when the last review was done, by whom, and when the next one is due.

Next steps

• Roles and permissions
• Audit log
• Require SSO and the owner fallback