Security Settings

Protect your organization with authentication, access controls, and compliance settings.

---

Quick security checklist

• Enable 2FA required for Admins (minimum)
• Enable 2FA required for All (recommended)
• Set idle timeout to 8 hours or less
• Configure IP allowlist for admin access (if fixed IPs)
• Review audit log monthly
• Set up SSO for enterprise (Enterprise plan)

---

Authentication

Settings → Security → Authentication

Password policy

:::tip A 12-character password with all complexity requirements takes centuries to brute-force. Max age of 90 days balances security and usability. :::

Two-factor authentication (2FA)

Settings → Security → Two-factor authentication

Supported methods:

• Authenticator app (recommended) - Google Authenticator, Authy, 1Password, Microsoft Authenticator
• SMS - Backup method, less secure
• Email - Backup method, least secure

:::warning When changing from Optional to Required, users without 2FA will be prompted to set it up on next login. Give your team advance notice. :::

---

Single Sign-On (SSO) - Enterprise

Settings → Security → Single sign-on

Connect your identity provider for centralized authentication.

Supported providers

• Okta (SAML/OIDC)
• Azure AD / Entra ID (SAML/OIDC)
• Google Workspace (SAML/OIDC)
• Custom SAML 2.0 / OIDC

Setup steps

1. Choose provider - Select from list or Custom
2. Configure IdP - Add AfricaOS as SAML/OIDC application in your IdP
   • Assertion Consumer Service (ACS) URL: https://your-org.africaos.dev/auth/sso/callback
   • Entity ID / Audience: https://your-org.africaos.dev
   • NameID Format: Email address
3. Attribute mapping - Map IdP attributes to AfricaOS fields:
   • Email (required)
   • First name, Last name
   • Role (optional, for auto-role assignment)
   • Groups (optional, for workspace access)
4. Test connection - Use "Test SSO" button with a test account
5. Enable - Toggle on, choose enforcement:
   • SSO optional - Users can use password or SSO
   • SSO required - Password login disabled

Provisioning

• Just-in-Time (JIT) - Auto-create users on first SSO login
• SCIM 2.0 - Sync users/groups from IdP (Okta, Azure AD)

:::info SSO requires Enterprise plan. Contact sales@africaos.dev to upgrade. :::

---

Access control

IP allowlist

Settings → Security → IP allowlist

Restrict access to approved networks (CIDR notation).

Format: CIDR notation (e.g., 192.168.1.0/24, 203.0.113.0/24)

• One CIDR per line
• Max 50 entries per list
• Owner emergency override - Owner can always access from any IP

:::warning Test your IP allowlist from a non-allowed IP before enabling. Owner always has emergency access. :::

Session management

Settings → Security → Sessions

Device management:

• View all active sessions per user
• Revoke individual sessions
• Force logout all sessions for a user

Device trust (Enterprise)

Settings → Security → Device trust

• Require managed devices - Only devices enrolled in your MDM
• Certificate-based auth - Client certificates for mutual TLS
• Device health checks - OS version, disk encryption, screen lock, biometrics
• Supported MDMs - Jamf, Intune, Kandji, Mosyle, custom via API

---

Compliance

Data protection standards

Audit logging

All security events logged automatically:

View audit log: Settings → Security → Audit log

• Filter by date, user, event type, IP
• Export as CSV/JSON
• Stream to SIEM (Enterprise)

Certifications

Download compliance documents: Settings → Security → Compliance → Download reports

---

Incident response

If you suspect a security incident:

1. Immediate - Owner: Settings → Security → Force logout all sessions for affected user
2. Investigate - Check audit log for suspicious activity
3. Contain - Suspend user, revoke sessions, update IP allowlist
4. Report - Email security@africaos.dev with details
5. Recover - Reset passwords, re-enable 2FA, review permissions

---

Related

• Organization setup
• Team management
• Roles & permissions
• Data & privacy