> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/settings/advanced-security-settings-overview.md).

# Advanced Security Settings Overview

<figure><picture><source srcset="/files/jypDFfWbGscvw6RC06b1" media="(prefers-color-scheme: dark)"><img src="/files/vm8AF0sTBnVJpl6q31Zk" alt=""></picture><figcaption></figcaption></figure>

### <mark style="color:$primary;">Password Policy</mark>&#x20;

There are default settings for the password policy, but these are all editable.&#x20;

* Minimum length \[Default = 12]&#x20;
* Require Numbers \[Default = On]&#x20;
* Require Lowercase \[Default = On]&#x20;
* Require Uppercase \[Default = On]&#x20;
* Require Special Characters \[Default = Off]&#x20;
* Password Lockout Duration (seconds) \[Default = 60]&#x20;
* Password Lockout Threshold (number of attempts) \[Default = 60]&#x20;

Existing users will not be notified of any changes to the password policy, nor will they be prompted to make a new password. To ensure users are in line with an updated password policy, an administrator will need to go into User Management and manually reset users' passwords.&#x20;

<figure><picture><source srcset="/files/JeZhpzizlUHesPVskGU9" media="(prefers-color-scheme: dark)"><img src="/files/RvZmJQNre1dFrmZn78mp" alt=""></picture><figcaption></figcaption></figure>

### <mark style="color:$primary;">MFA (Multi-Factor Authentication)</mark>&#x20;

There are default settings for MFA, but these are all editable. Whilst MFA is available for use, it is not automatically a requirement for logging in; this can be toggled on.&#x20;

* Require MFA \[Default = Off]&#x20;
* MFA Grace Period (days) \[Default = 30]&#x20;
* MFA Lockout Duration (seconds) \[Default = 60]&#x20;
* MFA Lockout Threshold (number of attempts) \[Default = 60]&#x20;
* Session Duration (seconds) \[Default = 3600]&#x20;

The MFA Grace Period refers to how long a user has to set up their authentication method – after this amount of time, the user will not be able to log in without authentication.&#x20;

There are multiple options for MFA apps (Microsoft Autheticator, Okta, Google etc), as long as it’s an app based one-time password with QR scanning abilities, you can use your preferred option.&#x20;

{% content-ref url="/pages/WORqStsDryCXzUyaSWGk" %}
[Setting Up MFA](/settings/advanced-security-settings-overview/setting-up-mfa.md)
{% endcontent-ref %}

### <mark style="color:$primary;">Security Keys</mark>&#x20;

This is off by default – once you have turned this on, it cannot be turned off. When you turn this on, you should ensure that the domain is yours.&#x20;

Security keys are small physical devices (often USB, NFC, or Bluetooth) working as two-factor authentication. We store the public key and your physical device will hold the private key. During login, the service sends a challenge that only your physical key can answer. As they are hardware based they cannot be phished, guessed or intercepted.&#x20;

### <mark style="color:$primary;">SSO (Single Sign-On)</mark>&#x20;

SSO allows for easier user management with a centralised login to identify a user across many apps. Single Sign-On is off by default; there are several steps to getting this set up.&#x20;

### <mark style="color:$primary;">Quick Guide</mark>&#x20;

* Create a new Enterprise Application in Microsoft Entra ID.&#x20;
* Open Single sign-on and choose SAML.&#x20;
* Copy the Issuer Callback URL from CybaOps into Microsoft’s Identifier and Reply URL.&#x20;
* Download the Base64 certificate from Microsoft and paste it into CybaOps.&#x20;
* Copy the Provider Login URL from Microsoft into CybaOps.&#x20;
* Assign users in Microsoft and test the SSO login.&#x20;

{% content-ref url="/pages/vYbcsTgnyi9SyLaP5kcG" %}
[Setting Up Single Sign On (SSO)](/settings/advanced-security-settings-overview/setting-up-single-sign-on-sso.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybaops.com/settings/advanced-security-settings-overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.