Organization security settings

Under «Manage» › «Security» you decide whether your organization uses approver phones, whether a password always needs a second factor and whether people may sign in with their phone alone.

Before you start

The pane only shows and changes the settings after a recent confirmation: choose «Confirm with passkey to view and change». Every change is recorded in the audit.

Approver phones: «Allow phone approvals»

• Off by default.
• On: people can link Android phones and approve sign-ins, sensitive changes and, for the operation types you choose, third-party requests on them. The console shows «Phone approvals are on for this organization.»
• Off after being on: «Phone approvals are off. Phones stay registered but approve nothing.»

Phone approval is multi-factor, but not phishing-resistant. For applications that need that assurance, keep passkey-only rules in your policies.

Sign-in

Even with «Require a second factor at sign-in» off, a password is never enough on an account that already has a passkey or phone.

Confirmation of administrative changes

See Confirmation of administrative changes.

Assisted authenticator reset

See Dual approval of resets.

Recommended setup

Before turning restrictive options on, make sure every administrator has two passkeys (or a passkey and a phone) and stored recovery codes.

Errors

«Someone else changed this setting. Refresh and try again.»: another administrator saved first.