Two-factor authentication, passwords and single sign-on

Require two-factor authentication, set a maximum password age, and sign in with your organization’s identity provider through single sign-on.

Open "Security" in "Organization settings" to set sign-in rules for everyone in your organization.

Two-factor authentication

Turn on "Require two-factor authentication for all members" to make everyone verify with an authenticator app each time they sign in.

Passwords

Set a maximum password age, from 1 to 365 days, to make people choose a new password regularly. Leave it blank for no limit. The Primary Site Administrator can also send a password reset or require a particular member to change their password.

Single sign-on

Organizations with an OpenID Connect identity provider, such as Microsoft Entra ID or Okta, can sign in with single sign-on. Legion Diagnostics sets up the connection with your IT team using OpenID Connect and your email domain. Members then click "Single sign-on" on the sign-in page and enter their work email.

Single sign-on proves who someone is; it does not decide what they can do. People still need an invitation to join, and their role, site groups and subspecialties are set on the "Team" page. Someone who signs in through your identity provider without an invitation is told to ask an administrator. When two-factor authentication is required, the identity provider's own multi-factor sign-in counts.