Skip to main content
This guide covers how to configure authentication security settings for your workspace, including two-factor authentication enforcement, passkey registration, session timeouts, and password requirements.
This feature requires administrator or workspace owner permissions. Changes made here affect all users in your workspace.
Who should read this: Workspace administrators and account owners responsible for organizational security policy.Prerequisites: Admin or Account Owner role. An active PlaneConnection workspace.

​
Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step after password entry. PlaneConnection supports TOTP-based 2FA (authenticator apps like Google Authenticator, Authy, or 1Password) and SMS-based verification codes.

​
Enable 2FA for your account

Individual users can enable 2FA from their profile settings. As an admin, you can enforce 2FA for all users.
Backup codes are shown only once. If you lose both your authenticator device and your backup codes, you will need to contact your workspace admin to reset your 2FA.

​
Enforce 2FA for all users

To require all workspace members to use two-factor authentication:
When 2FA enforcement is enabled with a grace period, users can still sign in without 2FA during the grace window but see a persistent banner reminding them to set it up. After the grace period expires, users must complete 2FA setup before accessing any workspace features.
For aviation operations, enforcing 2FA is strongly recommended. Safety report data, crew records, and financial information are sensitive — 2FA reduces the risk of unauthorized access from compromised passwords.

​
Passkeys

Passkeys provide passwordless authentication using biometrics (fingerprint, face recognition) or hardware security keys. They are phishing-resistant and more secure than passwords.

​
Register a passkey

Users can register multiple passkeys for different devices. Each passkey is tied to a specific device and browser combination.

​
Remove a passkey

Navigate to Profile & Security > Passkeys and click the Remove button next to the passkey you want to delete. You must have at least one other authentication method (password or another passkey) to remove a passkey.

​
Session Policies

Session policies control how long users stay signed in and under what conditions sessions expire.

​
Configure session duration

Very short idle timeouts (15 minutes) can frustrate dispatchers and safety managers who work in the platform all day. Consider the operational workflow before setting aggressive timeouts. A 1-hour idle timeout with 24-hour maximum lifetime provides a reasonable balance for most flight departments.

​
Force sign-out all users

In an emergency (compromised credentials, terminated employee), you can force-expire all active sessions:
  1. Navigate to Settings > Security > Sessions.
  2. Click Revoke All Sessions.
  3. Confirm the action.
All users are immediately signed out and must re-authenticate. This does not reset passwords or disable accounts.

​
Password Requirements

PlaneConnection enforces baseline password requirements through its authentication infrastructure. As an admin, you can configure additional policies.

​
Default password rules

All passwords must meet these minimum requirements:
  • At least 8 characters.
  • Cannot be a commonly breached password (checked against known breach databases).
  • Cannot be the same as the user’s email address.

​
Configure additional password policies

Navigate to Settings > Security > Password Policy to enable additional requirements:
Modern security guidance (NIST SP 800-63B) recommends longer passwords over complex character requirements. A 12+ character minimum with breach detection is more effective than requiring special characters with a short minimum length.

​
Authentication Methods Overview

PlaneConnection supports multiple authentication methods. The following table summarizes availability and configuration:

​
Security Audit Log

All authentication events are recorded in the workspace audit log:
  • Sign-in attempts (successful and failed)
  • 2FA enrollment and verification
  • Passkey registration and removal
  • Session creation and revocation
  • SSO configuration changes
  • Role and permission changes
Navigate to Settings > Audit Log to review authentication events. Filter by event type, user, and date range.

Configure SSO

Set up SAML-based single sign-on with your identity provider.

Manage Users and Roles

User provisioning, role assignment, and member management.

User Roles Reference

All 24 platform roles and their access scope.

Permissions Matrix

Detailed feature-by-role permissions breakdown.
Last modified on April 11, 2026