> ## Documentation Index
> Fetch the complete documentation index at: https://docs.planeconnection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Manage Security Settings

> Configure two-factor authentication, passkeys, session policies, and password requirements to secure your PlaneConnection workspace.

This guide covers how to configure authentication security settings for your workspace, including two-factor authentication enforcement, passkey registration, session timeouts, and password requirements.

<Warning>
  This feature requires **administrator** or **workspace owner** permissions. Changes made here
  affect all users in your workspace.
</Warning>

<Info>
  **Who should read this:** Workspace administrators and account owners responsible for
  organizational security policy.

  **Prerequisites:** Admin or Account Owner role. An active PlaneConnection workspace.
</Info>

## Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step after password entry. PlaneConnection supports TOTP-based 2FA (authenticator apps like Google Authenticator, Authy, or 1Password) and SMS-based verification codes.

### Enable 2FA for your account

Individual users can enable 2FA from their profile settings. As an admin, you can enforce 2FA for all users.

<Steps>
  ### Navigate to your profile

  Click your avatar in the top-right corner and select **Profile & Security**.

  ### Enable two-factor authentication

  Under the **Two-Factor Authentication** section, click **Enable 2FA**.

  ### Scan the QR code

  Open your authenticator app and scan the QR code displayed on screen. Enter the 6-digit verification code to confirm setup.

  ### Save backup codes

  After successful setup, PlaneConnection displays a set of backup codes. Save these in a secure location -- they are your only way to access your account if you lose your authenticator device.
</Steps>

<Warning>
  Backup codes are shown only once. If you lose both your authenticator device and your backup
  codes, you will need to contact your workspace admin to reset your 2FA.
</Warning>

### Enforce 2FA for all users

To require all workspace members to use two-factor authentication:

<Steps>
  ### Navigate to security settings

  Go to **Settings > Security** in the sidebar.

  ### Enable 2FA enforcement

  Toggle **Require Two-Factor Authentication** to on. Set a **Grace Period** (in days) to give existing users time to set up their authenticator app before enforcement takes effect.

  ### Save changes

  Click **Save**. Users who have not configured 2FA will see a prompt on their next sign-in.
</Steps>

<Info>
  When 2FA enforcement is enabled with a grace period, users can still sign in without 2FA during
  the grace window but see a persistent banner reminding them to set it up. After the grace period
  expires, users must complete 2FA setup before accessing any workspace features.
</Info>

<Tip>
  For aviation operations, enforcing 2FA is strongly recommended. Safety report data, crew records,
  and financial information are sensitive -- 2FA reduces the risk of unauthorized access from
  compromised passwords.
</Tip>

## Passkeys

Passkeys provide passwordless authentication using biometrics (fingerprint, face recognition) or hardware security keys. They are phishing-resistant and more secure than passwords.

### Register a passkey

<Steps>
  ### Navigate to your profile

  Click your avatar and select **Profile & Security**.

  ### Add a passkey

  Under the **Passkeys** section, click **Add Passkey**.

  ### Authenticate with your device

  Your browser prompts you to use your device's biometric sensor or insert a security key. Follow the on-screen instructions.

  ### Name the passkey

  Enter a descriptive name (e.g., "MacBook Pro Touch ID" or "YubiKey 5") so you can identify it later.
</Steps>

Users can register multiple passkeys for different devices. Each passkey is tied to a specific device and browser combination.

### Remove a passkey

Navigate to **Profile & Security > Passkeys** and click the **Remove** button next to the passkey you want to delete. You must have at least one other authentication method (password or another passkey) to remove a passkey.

## Session Policies

Session policies control how long users stay signed in and under what conditions sessions expire.

### Configure session duration

<Steps>
  ### Navigate to security settings

  Go to **Settings > Security > Sessions**.

  ### Set session lifetime

  Choose the maximum session duration:

  | Setting      | Description                                           | Recommended For              |
  | ------------ | ----------------------------------------------------- | ---------------------------- |
  | **8 hours**  | Session expires after 8 hours of the initial sign-in. | High-security environments.  |
  | **24 hours** | Default. Session lasts one day.                       | Most flight departments.     |
  | **7 days**   | Session persists for a week with activity.            | Low-turnover teams with MFA. |
  | **30 days**  | Extended session for convenience.                     | Only with 2FA enforced.      |

  ### Set idle timeout

  Choose how long an inactive session persists before requiring re-authentication:

  | Setting             | Behavior                                              |
  | ------------------- | ----------------------------------------------------- |
  | **15 minutes**      | Strict. Suitable for shared or kiosk devices.         |
  | **1 hour**          | Default. Balances security and usability.             |
  | **4 hours**         | Relaxed. Suitable when devices are physically secure. |
  | **No idle timeout** | Session only expires at the maximum lifetime.         |

  ### Save changes

  Click **Save**. Changes apply to new sessions; existing sessions use their original settings.
</Steps>

<Warning>
  Very short idle timeouts (15 minutes) can frustrate dispatchers and safety managers who work in
  the platform all day. Consider the operational workflow before setting aggressive timeouts. A
  1-hour idle timeout with 24-hour maximum lifetime provides a reasonable balance for most flight
  departments.
</Warning>

### Force sign-out all users

In an emergency (compromised credentials, terminated employee), you can force-expire all active sessions:

1. Navigate to **Settings > Security > Sessions**.
2. Click **Revoke All Sessions**.
3. Confirm the action.

All users are immediately signed out and must re-authenticate. This does not reset passwords or disable accounts.

## Password Requirements

PlaneConnection enforces baseline password requirements through its authentication infrastructure. As an admin, you can configure additional policies.

### Default password rules

All passwords must meet these minimum requirements:

* At least 8 characters.
* Cannot be a commonly breached password (checked against known breach databases).
* Cannot be the same as the user's email address.

### Configure additional password policies

Navigate to **Settings > Security > Password Policy** to enable additional requirements:

| Policy                    | Description                                              |
| ------------------------- | -------------------------------------------------------- |
| **Minimum length**        | Increase the minimum from 8 to up to 32 characters.      |
| **Require mixed case**    | Require at least one uppercase and one lowercase letter. |
| **Require numbers**       | Require at least one numeric digit.                      |
| **Require special chars** | Require at least one special character (!@#\$%^&\*).     |
| **Password history**      | Prevent reuse of the last N passwords (up to 10).        |

<Tip>
  Modern security guidance (NIST SP 800-63B) recommends longer passwords over complex character
  requirements. A 12+ character minimum with breach detection is more effective than requiring
  special characters with a short minimum length.
</Tip>

## Authentication Methods Overview

PlaneConnection supports multiple authentication methods. The following table summarizes availability and configuration:

| Method           | Default State  | Admin Configurable | Notes                                                                |
| ---------------- | -------------- | ------------------ | -------------------------------------------------------------------- |
| Email + Password | Enabled        | Cannot disable     | Always available as a baseline method.                               |
| Google OAuth     | Feature toggle | Yes                | Sign in with Google. Enable via **Settings > Modules**.              |
| Microsoft OAuth  | Feature toggle | Yes                | Sign in with Microsoft. Enable via **Settings > Modules**.           |
| SAML SSO         | Feature toggle | Yes                | Enterprise SSO. See [Configure SSO](/en/how-to/admin/configure-sso). |
| Magic Link       | Feature toggle | Yes                | Passwordless email link. Enable via **Settings > Modules**.          |
| Passkeys         | Feature toggle | Yes                | Biometric/hardware key. Enable via **Settings > Modules**.           |
| TOTP 2FA         | Opt-in         | Enforceable        | Authenticator app codes as second factor.                            |

## Security Audit Log

All authentication events are recorded in the workspace audit log:

* Sign-in attempts (successful and failed)
* 2FA enrollment and verification
* Passkey registration and removal
* Session creation and revocation
* SSO configuration changes
* Role and permission changes

Navigate to **Settings > Audit Log** to review authentication events. Filter by event type, user, and date range.

## Related

<CardGroup cols={2}>
  <Card title="Configure SSO" href="/en/how-to/admin/configure-sso">
    Set up SAML-based single sign-on with your identity provider.
  </Card>

  <Card title="Manage Users and Roles" href="/en/how-to/admin/manage-users">
    User provisioning, role assignment, and member management.
  </Card>

  <Card title="User Roles Reference" href="/en/reference/user-roles">
    All 24 platform roles and their access scope.
  </Card>

  <Card title="Permissions Matrix" href="/en/reference/permissions">
    Detailed feature-by-role permissions breakdown.
  </Card>
</CardGroup>