MFA Requirements and Session Limits
Require multi-factor authentication for password sign-in, limit how long Organization sessions last, and revoke a member's sessions when access should end.
Open Governance → Policies → Authentication to review Organization access policy and member sessions. Owner, Admin, Identity Admin, and Security Admin can manage these controls. Sensitive changes require recent authentication when requested.
Configure access policy
Review the policy before enabling enforcement. Set the session lifetime, idle timeout, and how recently a person must authenticate before sensitive changes. If requiring MFA, confirm affected members have completed setup in their account security settings.
The Organization's MFA requirement applies to password-based access when the account has a usable password. SSO access uses the Organization's SSO authentication flow; configure the required assurance at your identity provider as well. The control does not turn every connected provider or API key into an MFA-protected login.
When Enforce access policy is enabled, members may need to authenticate again or complete MFA before re-entering protected Organization views. Explain the change before shortening sessions so members know how to regain access. Keep an authorized Owner able to use the SSO recovery process.
Inspect and end sessions
The member security view shows recorded authentication posture and Organization sessions, including the available device, IP address, and activity information. Use those records as evidence of recorded access, not a complete history of everything the person did.
End a selected session or use the available controls to end other sessions. The current session has protections in the bulk controls so an administrator does not accidentally remove the session performing the operation. Read the confirmation to see the affected member and scope.
Revocation ends that Organization access grant. It does not necessarily sign the person out of their personal workspace, other Organizations, or the identity provider itself. An eligible member may regain access by completing a fresh authentication flow.
Offboard a member
For permanent removal, change or remove membership through People & roles, or deactivate the person through the configured directory provisioning flow. Revoking sessions alone is insufficient if membership still allows the person to sign in again.
Review their Team memberships, pending approvals, connected accounts, API keys, and machine identities. Background agents and machine credentials have their own authorization paths; a human session policy does not suspend them automatically. Reassign ongoing responsibilities before removing the only person who can approve a workflow.
Record the decision in an Access Review, and inspect security activity to confirm the administrative change.