System → Security is where you set the sign-in policy for your whole organization. These controls protect your organization's data by raising the bar for who can get in and how.
Requiring two-factor authentication#
The most impactful control here is requiring two-factor authentication (2FA) for everyone. When you turn this on:
- Every user must set up an authenticator app to sign in.
- Anyone without 2FA is prompted to configure it the next time they sign in and can't skip it.
- A stolen password alone is no longer enough to access an account.
For organizations handling client data, requiring 2FA is a strong, low-effort security win. See Accounts & signing in for the individual's setup steps.
Passkeys and the 2FA requirement#
Anyone can add a passkey (Face ID, Touch ID, Windows Hello, a security key) from Account settings → Security and sign in with it in one step. A passkey is possession of the device plus the biometric or PIN that unlocks it — two factors already — so a passkey sign-in never asks for an authenticator code. Requiring 2FA still means everyone must set up an authenticator app: that protects the password path, which stays available as the fallback. Passkey enrolment, renaming and removal appear in the audit log like any other account change.
Other sign-in controls#
The Security page is a set of cards. Change what you need and save; the settings apply to everyone in the organization.
- Two-step sign-in — beside Require it for everyone, Allow "Remember this device" lets people skip the code on devices they trust, and Remember a device for sets how many days before the code is asked for again.
- Passwords — Passwords expire after (a number of days) makes people choose a new password, and Block reusing recent passwords sets how many previous passwords can't be used again. 0 turns either rule off.
- Sign-in attempts — Lock the account after sets how many wrong passwords in a row lock an account, and Keep it locked for sets how many minutes before it unlocks on its own.
- Sessions — Sign out after inactivity signs people out after that many idle minutes (0 turns it off), and One active session per person signs a person out everywhere else when they sign in on a new device.
- Network restrictions — to limit where people can sign in from, turn on Only allow sign-in from approved networks and add the addresses or ranges (for example 203.0.113.0/24) under Allowed addresses and ranges. An empty list never blocks anyone, and signing out always works.
Single sign-on#
People can sign in with Sign in with Microsoft or Sign in with Google on the sign-in page when the email on that account matches their AspirePro user. There is nothing to switch on in System: the buttons are there for everyone, and the security settings above (two-step sign-in, sessions and network restrictions) still apply.
Good security practice#
- Require 2FA across the organization once your team is set up.
- Use roles to grant least-privilege access — people should have what they need and no more (see Roles & permissions).
- Deactivate users promptly when they leave (see Users).
- Encourage everyone to review their active sessions and sign out ones they don't recognize (see Your profile & preferences).
- Rely on the audit log to review significant changes (see Audit log).
Security is layered: 2FA protects sign-in, roles limit blast radius, and the audit log gives you accountability after the fact. Use all three together.