This article explains how to configure the settings in the Security & Access section of the Company Settings screen. Anyone who can open the page can view the settings, but changing them requires the Company Permission Settings permission. Without it, each card shows "You can view this setting, but you do not have permission to edit it."
The section contains these cards, from top to bottom:
Card | What it does |
Trusted IP Ranges | Allows access only from the IP addresses you define. |
Multi-Factor Authentication (MFA) | Asks for a one-time code after the password at sign-in. |
Account Lockout | Closes an account to sign-in for a while after repeated wrong passwords. |
Token Replay Protection | Blocks an identical request from being processed twice. |
Inactivity Screen Lock | Locks an idle screen and asks for the password to continue. |
Teamso Support Access | Grants the support team time-limited or unlimited (until you revoke it) access. Covered in a separate article: Teamso Support Access. |
The settings apply to every user in the company; they cannot be switched on or off per person.
Before you start
You need the Company Permission Settings permission (Manage Permissions).
If you will restrict by IP, know your office's static public IP address or your VPN exit address.
If you will use the SMS channel for MFA, make sure you have enough Digital Credits (Digital Credits).
Step by step
In the left menu, go to Configuration > Company settings.
In the settings menu on the left, click Security & Access under the Security group.
Turn on the switch at the top right of the card you want to change and enter the parameters. The card header shows the setting's name, its saved status (Active / Inactive) and a short description; hover over the (i) icon for the full explanation. The status label does not change until you save: when you flip the switch, → Active (not saved) or → Inactive (not saved) appears next to it.
As soon as you change something, an Unsaved changes bar opens at the bottom of the card. Click Save, or Discard to undo. Each card is saved separately; Save is not shown while there is nothing to save.
While a feature is off, its parameter fields have a grey background and cannot be edited; the values stay readable. The card header says Turn on to edit.
IP-based access control
Turn on the switch at the top right of the Trusted IP Ranges card.
Under Authorized IP / CIDR Definitions, type a single IP (e.g. 192.168.1.10) or a CIDR block (e.g. 10.0.0.0/8) and click Add (Enter also adds it). The IP address you are connected from is shown below the field; use Add current IP address in the warning to add the network you are on. Added addresses appear in the list below; remove one with its bin icon.
Click Save.
The control cannot be turned on without at least one address: while the list is empty, Save stays disabled and hovering over it shows why. In the red warning at the top of the card, Add current IP address adds the address you are connected from in one click.
If your connecting IP is not in the list when you save, it is added automatically so that you do not lose access.
Invalid values are not saved, and you are told which values were dropped.
While the control is on, a user connecting from an address outside the list sees the Access Denied screen. This applies to every session, including the mobile app, so take the networks of field and remote staff into account.
Additional verification at sign-in (MFA)
Turn on the switch at the top right of the Multi-Factor Authentication (MFA) card.
Choose Email or SMS as the Verification Channel.
Click Save. If you chose SMS, the SMS Channel Notice window opens; confirm with I Confirm, Save.
When it is on, every user enters a 6-digit code in addition to their password at each sign-in (Verify and Sign In).
The email channel works for every user.
Each verification SMS deducts 1 credit from your Digital Credit balance. If the balance is insufficient or the user has no registered phone number, the code is sent by email instead and sign-in is not blocked.
Account lockout on failed sign-ins
Turn on the switch at the top right of the Account Lockout card.
Enter Maximum Failed Attempts (3–10) and Lock Duration (minutes) (1–1440).
Click Save.
The counter only counts consecutive failed attempts and resets on a successful sign-in. When the period ends the lock is lifted automatically. Use the Failed Sign-In Records button at the bottom of the card to see failed sign-ins and lockout events.
Replay protection
Turn on the switch at the top right of the Token Replay Protection card and click Save. No extra action is needed for users on the current application version. Requests from devices with a wrong clock may be rejected; those users should set their date and time to update automatically.
Inactivity screen lock
Turn on the switch at the top right of the Inactivity Screen Lock card.
Enter a value between 1 and 480 in Inactivity Period (minutes).
Click Save.
The timer resets on mouse, keyboard and touch input. When the screen locks, the session stays open and the data on the page is kept; the user enters their password in the Screen Locked window and clicks Continue, or chooses Log Out.
Result
The saved setting applies to all users in the company immediately. Once the save succeeds, the status label in the card header changes to Active or Inactive, followed by a short summary of the setting (e.g. "5 attempts · 15 min lock").
Common problems
Symptom: An employee sees the "Access Denied" screen.
Cause: IP control is on and the employee's network address is not in the list.
Solution: Add the IP address shown on that screen to Trusted IP Ranges, or have the employee connect to the company network or VPN.
Symptom: SMS is selected but the code arrives by email.
Cause: The Digital Credit balance is insufficient or the user has no registered phone number.
Solution: Top up credits and check the employee's phone number.
Symptom: A user is told their account has been temporarily locked.
Cause: The limit of consecutive wrong passwords was exceeded.
Solution: Wait for the lock duration to pass; the lock is lifted automatically.
Symptom: I can see the cards but cannot change them.
Cause: You do not have the Company Permission Settings permission, or you are in a Teamso support session (security settings cannot be changed in a support session).
Solution: Ask your administrator for the permission.
Symptom: Save is disabled on the Account Lockout or Inactivity Screen Lock card.
Cause: The number of attempts, the lock duration or the inactivity time was left empty. An empty value is not saved; hovering over Save shows why.
Solution: Enter a value, or use Discard to go back to the saved value.