TrainMeUK LogoTrainMeUK

Password Policy & MFA

Configure password requirements and multi-factor authentication

Overview

Security settings control:

  • Password complexity requirements
  • Password expiry and history
  • Account lockout policies
  • Multi-factor authentication options

These settings apply organisation-wide.

Accessing Security Settings

1

Open Admin Settings

  1. Log in as an Admin (with appropriate permissions)
  2. Go to Admin → Settings
  3. Select the Security tab

Password Policy Settings

Password policy section
The Password Policy section in Security Settings

Password Complexity

Control what passwords must contain:

SettingPurposeRecommended
Minimum LengthShortest allowed password8-12 characters
Require UppercaseMust contain A-ZYes
Require LowercaseMust contain a-zYes
Require NumbersMust contain 0-9Yes
Require Special CharactersMust contain !@#$% etc.Optional

Configuring Password Complexity

  1. Navigate to Security Settings
  2. Find the Password Policy section
  3. Set your requirements: enter minimum length, toggle on/off required character types
  4. Click Save

Password Age

Control how long passwords remain valid:

SettingPurposeExample
Maximum Password AgeDays until password expires90 days
Password Never ExpiresDisable expiryToggle on/off

Password History

Prevent reuse of recent passwords:

SettingPurposeExample
Remember Previous PasswordsHow many old passwords to block5 passwords

Account Lockout Settings

Protect against brute-force attacks:

SettingPurposeRecommended
Failed Login AttemptsAttempts before lockout5
Lockout DurationMinutes account is locked15-30 minutes
Reset Counter AfterMinutes before counter resets15 minutes

What Happens on Lockout

  • User sees "Account locked" message
  • Must wait for lockout period
  • Or contact admin for manual unlock

Multi-Factor Authentication (MFA)

Add an extra layer of security beyond passwords.

MFA setup screen
The MFA configuration options in Security Settings

MFA Options Available

MethodDescription
Authenticator AppTOTP codes from apps like Microsoft Authenticator
Email CodeOne-time code sent via email
Backup CodesOne-time recovery codes

Configuring MFA Settings

  1. In Security Settings, find Multi-Factor Authentication section
  2. Configure MFA Requirement: Optional or Required
  3. Enable/disable authenticator app option
  4. Enable/disable email verification codes
  5. Enable/disable backup codes
  6. Click Save

Tip

Authenticator apps are the most secure method. Always enable backup codes as a recovery option.

Step-by-Step: Enforcing MFA

1

Enable MFA Features

  1. Go to Security Settings
  2. Enable authenticator app and/or email codes
  3. Enable backup codes as recovery option
  4. Save
2

Set MFA as Required

  1. Find "MFA Required" setting
  2. Toggle to Required
  3. Save
3

Communicate to Users

Let users know:

  • MFA is now required
  • How to set it up
  • Where to get help

What Users Experience

First Login After MFA Required

  1. User logs in with password
  2. Prompted to set up MFA
  3. Scans QR code with authenticator app
  4. Enters verification code to confirm
  5. Receives backup codes to save
  6. Future logins require code from app

Subsequent Logins

  1. Enter username and password
  2. Enter code from authenticator app
  3. Access granted

Best Practices

Password Policy

AreaRecommendation
Length8-12 minimum
ComplexityRequire upper, lower, and numbers
Expiry90 days (or never with MFA)
HistoryRemember last 5 passwords

MFA

AreaRecommendation
RequirementHighly recommended for admins
MethodAuthenticator app preferred
BackupAlways enable backup codes

Account Lockout

AreaRecommendation
Attempts5 failed attempts
Duration15-30 minutes

Tip

Balance security and usability. Too strict = frustrated users. Too lenient = security risk. Find the right balance for your organisation.

Temporary Passwords

When admins create users with temporary passwords:

  • Temporary passwords may bypass complexity requirements
  • Users must change password on first login
  • The new password must meet complexity requirements

This allows admins to create simple temporary passwords for new users.

Troubleshooting

User locked out

Wait for lockout period, or go to User Management and unlock manually. Check for suspicious activity.

User forgot MFA device

Use backup codes if they saved them. Admin can reset MFA in User Management. User sets up MFA again.

Password rejected as too simple

Check complexity requirements. Ensure all requirements are met. Try a longer, more complex password.

MFA code not working

Check device time is correct (TOTP is time-sensitive). Ensure using correct authenticator. Try a fresh code (they refresh every 30 seconds).

Need to disable MFA temporarily

Consider if really necessary. Admin can disable for specific user in emergency. Re-enable as soon as possible.

Compliance Considerations

Financial Services

Often require: MFA for all users, 90-day password expiry, Strong complexity requirements

Healthcare

Often require: Audit trails of access, Strong authentication, Session timeouts

Education

Requirements vary: Check Ofsted/regulatory requirements, Consider safeguarding access controls

Related Guides