Skip to content
AurionAI

Dashboard authentication and sessions

5 min readBy Emmanuel Yazbeck

The Web Authentication page controls how your team signs in to the AurionAI dashboard. You choose the sign-in methods, the password rules, the session timeouts, two-factor authentication, an IP allowlist and the lockout after failed sign-ins.

Availability: all profiles. Administrators only.

Prerequisites

  • You have the Owner or Admin role. Other roles cannot open this page.
  • The page is available in every product profile and on every plan.
  • Before you set an IP allowlist, know the IP address ranges of your offices in IPv4 CIDR notation.

Dashboard staff or end users

This page applies only to the people who use the AurionAI dashboard: administrators, supervisors, agents and read-only users. It does not change how end users sign in to the Help Center or the mobile app. For end users, read Single sign-on for end users.

Open the page

  1. In the sidebar, select Configuration.
  2. Open the Identity & Access category.
  3. Select Web Authentication.

The page has six cards. You change the values in the cards, then save once at the bottom of the page.

The Web Authentication page with the sign-in methods card.

Choose the sign-in methods

In the Sign-in methods card, turn each method on or off:

  • Email + Password
  • Google SSO
  • Microsoft SSO
  • Magic Link
  • Passkey (WebAuthn)

At least one method must stay on. All methods are on by default.

The sign-in page is shared by all organizations. Before a user is identified, the page can still show a method that you turned off. AurionAI refuses that method when the user tries it.

Set the password rules

In the Password complexity card:

  1. In Minimum length, enter a number from 8 to 128. The default is 12.
  2. Turn on or off the rules for uppercase letters, lowercase letters, numbers and symbols. By default, uppercase letters, lowercase letters and numbers are required. Symbols are not required.

The rules apply when a user sets or changes a dashboard password.

Set the session timeouts

In the Session timeouts card:

  1. In Absolute session timeout (minutes), enter a number from 15 to 10080. The default is 480 minutes (8 hours).
  2. In Idle timeout (minutes), enter a number from 5 to 1440. The default is 720 minutes (12 hours).

The absolute timeout is the lifetime of the session token that a user gets at sign-in. Activity can extend some sessions up to a platform limit. The idle timeout signs a user out after that time without activity. With the default values, the absolute timeout always ends the session first. To use the idle timeout, set it lower than the absolute timeout.

Require two-factor authentication

In the Multi-factor authentication card, select one option:

  • None — MFA not required. This is the default.
  • Admins only — required for tenant admins and owners
  • All users — required except for Microsoft Entra organization SSO; use Conditional Access there

When two-factor authentication is required, a user without an authenticator app must set one up during the next sign-in. Read Two-factor authentication.

Two-factor authentication from this page does not apply when your organization signs in through its own Microsoft Entra organization SSO. Use Conditional Access in Microsoft Entra for these users. The Sign in with Microsoft button on the sign-in page does apply it.

Restrict sign-in to your IP addresses

In the IP allowlist card:

  1. Enter one IP range per line, in IPv4 CIDR notation. For example, 192.168.1.0/24.
  2. Leave the field empty to allow sign-in from any IP address. This is the default.

The host part of each range must be zero. Enter 10.0.0.0/24, not 10.0.0.5/24. The card shows each invalid entry, and you cannot save until you correct it.

The allowlist accepts IPv4 only. A user who connects with an IPv6 address cannot sign in when the allowlist has entries.

Set the lockout after failed sign-ins

In the Web login lockout card:

  1. In Max failed attempts, enter a number from 3 to 20. The default is 5.
  2. In Lockout duration (minutes), enter a number from 1 to 1440. The default is 15 minutes.

Save the policy

  1. Select Save changes.
  2. If the window This allowlist locks you out opens, your own IP address is not in the allowlist. Select Go back and edit and add your address. Select Save anyway only if you are sure.
  3. If the window This allowlist blocks every IPv6 client opens, read it. Select Save anyway only if no user connects with IPv6.

Result

The message Web authentication policy updated appears.

The changes apply as follows:

  • Sign-in methods, two-factor authentication and the IP allowlist apply at the next sign-in of each user.
  • The idle timeout applies at once, also to users who are already signed in.
  • The password rules apply the next time that a user sets or changes a password.

If something goes wrong

  • Save changes is inactive. Turn on at least one sign-in method, and correct every invalid IP range.
  • Failed to update web authentication policy appears with a field name. A number is out of range. Check the limits in each card.
  • You are locked out by the IP allowlist. You saved an allowlist without your own IP address. Only AurionAI support can restore your access. Read Get help.
  • A user is locked out after failed sign-ins. The user can sign in again after the lockout duration.
  • A user does not get a two-factor prompt. The user signs in through Microsoft Entra organization SSO. Use Conditional Access in Microsoft Entra.
  • Could not load web authentication policy. Reload the page.

Still stuck? Submit a request or .