Password Policy & MFA
Configure password requirements and multi-factor authentication
Overview
Security settings control:
- Password complexity requirements
- Password expiry and history
- Account lockout policies
- Multi-factor authentication options
These settings apply organisation-wide.
Accessing Security Settings
Open System Settings
- Log in as an Admin
- Go to Admin → System Settings
- Select the Security tab
Password Policy Settings
Password Complexity
Control what passwords must contain:
| Setting | Purpose | Recommended |
|---|---|---|
| Minimum Length | Shortest allowed password | 8-12 characters |
| Require Uppercase | Must contain A-Z | Yes |
| Require Lowercase | Must contain a-z | Yes |
| Require Numbers | Must contain 0-9 | Yes |
| Require Special Characters | Must contain !@#$% etc. | Optional |
Configuring Password Complexity
- Navigate to Security Settings
- Find the Password Policy section
- Set your requirements: enter minimum length, toggle on/off required character types
- Click Save
Password Age
Control how long passwords remain valid:
| Setting | Purpose | Example |
|---|---|---|
| Maximum Password Age | Days until password expires | 90 days |
| Password Never Expires | Disable expiry | Toggle on/off |
Password History
Prevent reuse of recent passwords:
| Setting | Purpose | Example |
|---|---|---|
| Remember Previous Passwords | How many old passwords to block | 5 passwords |
Account Lockout Settings
Protect against brute-force attacks:
| Setting | Purpose | Recommended |
|---|---|---|
| Failed Login Attempts | Attempts before lockout | 5 |
| Lockout Duration | Minutes account is locked | 15-30 minutes |
| Reset Counter After | Minutes before counter resets | 15 minutes |
What Happens on Lockout
- User sees "Account locked" message
- Must wait for lockout period
- Or contact admin for manual unlock
Multi-Factor Authentication (MFA)
Add an extra layer of security beyond passwords.
MFA options in System Settings
| Setting | Description |
|---|---|
| Require MFA for all users | Force all users to set up MFA |
| Enable Authenticator App | Allow apps such as Google Authenticator |
| Backup Codes Count | How many backup codes to generate (5–20) |
| Email Code Expiry (minutes) | How long email codes remain valid (5–60) |
Configuring MFA Settings
- In Security Settings, open the Multi-Factor Authentication sub-tab
- Toggle Require MFA for all users if you want MFA mandatory
- Toggle Enable Authenticator App to allow authenticator apps
- Under MFA Configuration, set Backup Codes Count and Email Code Expiry (minutes)
- Click Save MFA Settings
Tip
Step-by-Step: Enforcing MFA
Enable MFA Features
- Go to Admin → System Settings → Security
- Open the Multi-Factor Authentication sub-tab
- Enable Enable Authenticator App
- Set Backup Codes Count and Email Code Expiry (minutes)
- Click Save MFA Settings
Require MFA for all users
- Toggle Require MFA for all users on
- Click Save MFA Settings
Communicate to Users
Let users know:
- MFA is now required
- How to set it up
- Where to get help
What Users Experience
First Login After MFA Required
- User logs in with password
- Prompted to set up MFA
- Scans QR code with authenticator app
- Enters verification code to confirm
- Receives backup codes to save
- Future logins require code from app
Subsequent Logins
- Enter username and password
- Enter code from authenticator app
- Access granted
Best Practices
Password Policy
| Area | Recommendation |
|---|---|
| Length | 8-12 minimum |
| Complexity | Require upper, lower, and numbers |
| Expiry | 90 days (or never with MFA) |
| History | Remember last 5 passwords |
MFA
| Area | Recommendation |
|---|---|
| Requirement | Highly recommended for admins |
| Method | Authenticator app preferred |
| Backup | Always enable backup codes |
Account Lockout
| Area | Recommendation |
|---|---|
| Attempts | 5 failed attempts |
| Duration | 15-30 minutes |
Tip
Temporary Passwords
When admins create users with temporary passwords:
- Temporary passwords may bypass complexity requirements
- Users must change password on first login
- The new password must meet complexity requirements
This allows admins to create simple temporary passwords for new users.
Troubleshooting
User locked out
Wait for lockout period, or go to User Management and unlock manually. Check for suspicious activity.
User forgot MFA device
Use backup codes if they saved them. Admin can reset MFA in User Management. User sets up MFA again.
Password rejected as too simple
Check complexity requirements. Ensure all requirements are met. Try a longer, more complex password.
MFA code not working
Check device time is correct (TOTP is time-sensitive). Ensure using correct authenticator. Try a fresh code (they refresh every 30 seconds).
Need to disable MFA temporarily
Consider if really necessary. Admin can disable for specific user in emergency. Re-enable as soon as possible.
Compliance Considerations
Financial Services
Often require: MFA for all users, 90-day password expiry, Strong complexity requirements
Healthcare
Often require: Audit trails of access, Strong authentication, Session timeouts
Education
Requirements vary: Check Ofsted/regulatory requirements, Consider safeguarding access controls
Related Guides
- Creating Users - User account setup
- User Roles & Permissions - Access control settings
- Adding Frameworks - Compliance frameworks