# Dashboard access security

The dashboard can reach every end user of your environments, so access to it follows a fixed security baseline on every plan. No account setting can switch these protections off.

## Multi-factor sign-in

- Every dashboard sign-in must use multi-factor authentication. If a sign-in was not multi-factor, the dashboard asks you to sign in again with a second factor before it shows or changes anything in your environments.
- Members with the `owner` or `admin` role must use a passkey or a security key to work in environments. An authenticator app code is not enough for these roles.

## Sessions

| Rule | Value |
|---|---|
| Idle timeout | 30 minutes without activity |
| Maximum session length | 12 hours, whatever the activity |
| Sessions per person | 5; signing in a sixth time ends the oldest session |
| Sign-out | Ends the session at once |

A session is bound to the browser that started it: to a key the browser creates and cannot export, and to a device cookie. A request that presents another key or another device cookie ends the session, and KeenAuth sends the session's owner a security notice email (at most one per hour).

The session also watches the network you use:

- When your IPv4 /24 or IPv6 /56 network changes, the dashboard asks you to sign in again before it continues.
- When your network provider (autonomous system) changes, the session ends. If the provider of an address is not known, this rule does not apply and the network rule above still does.

## Sensitive actions

Team management, custom roles, ownership transfer, closing the account, creating `production` environments, deleting environments, changing the issuer mode, plan and billing changes, platform support access grants and dashboard security settings are accepted only if you signed in during the last 5 minutes. Otherwise the dashboard asks you to sign in again and then continues. The same list is in [Manage your dashboard team](/docs/guides/dashboard-team).

## How access to an environment is checked

The dashboard does not hold a general key to your environments. For each environment you open, it receives a short-lived access token:

- It is valid for 5 minutes and for one environment only.
- It is bound to your browser's key, so it cannot be used from another browser.
- It lists the permissions your roles give you in that environment.

The region that holds the environment checks the signature, the environment, the account and every permission again on each request. What the dashboard hides or shows is only a convenience; the decision is made where the data lives.

## When a role is removed

When one of your roles is revoked, or you are removed from an account, your dashboard sessions and access tokens for that account are revoked. Ending your membership does not wait for the 5-minute token lifetime.

## Single sign-on for the dashboard

On the Business and Enterprise plans an account can require its members to sign in to the dashboard through the company's identity provider. Owners and admins manage this on the **Dashboard security** screen (`/account/security`). Every change there is a sensitive action: you must have signed in during the last 5 minutes.

### Set up the connection and directory

The SAML or OpenID Connect connection, the SCIM directory and the verified domains used for dashboard sign-in are set up in the Admin Portal. Select **Open the Admin Portal** on the Dashboard security screen. The link opens once and expires after 5 minutes.

### Require single sign-on

- When single sign-on is required, members of the account must sign in through the account's identity provider connection. A member who signed in another way is asked to sign in again with single sign-on before the dashboard continues. The same rule applies to command-line (CLI) sign-ins for the account.
- You can turn the requirement on only if you are signed in with single sign-on yourself, or if the account has at least one break-glass owner. This keeps the account from being locked out by a connection that does not work.
- Turning the requirement off is always possible, also after a plan downgrade.

### Break-glass owners

- An owner can mark up to 2 owners as break-glass owners. Only owners can mark or unmark them.
- If the identity provider is unavailable, a break-glass owner can sign in without single sign-on, with a passkey or a security key only.
- Every break-glass sign-in is recorded in the account's audit log and emailed to the account's owners.

### Directory group roles

You can give the members of a SCIM group from your directory a dashboard role. On the Dashboard security screen, under **Directory group roles**, select **Map a group** and enter the group's ID (shown in the Admin Portal), the role and the scope.

- An account can have up to 20 group mappings. The `owner` role is never given by a group: ownership always belongs to a person.
- You can map only roles you are allowed to give yourself. Creating and removing mappings needs the team management permission.
- Members of a mapped group get the role within about 5 minutes. A member who leaves the group loses the role at the next synchronisation. A person in the group who is not yet a member of the account is added as a member.
- A role that comes from a group is marked "(from a directory group)" on the Team screen. It cannot be revoked there; change the group in your directory or remove the mapping.
- Removing a mapping removes the roles it gave, at once. Roles given by hand are never changed by group synchronisation, and a member who was removed from or suspended in the account is not added back.
- If the directory cannot be reached, roles from groups are kept for at most 1 hour after the last successful synchronisation, then removed until the directory answers again. A synchronisation error never adds a role.
- After a downgrade below Business, roles from groups are removed.

## Not available yet

- Account settings that shorten session lifetimes, require phishing-resistant sign-in for every member, or allow authenticator app codes for `owner` and `admin`.
- Email notices for a sign-in from a new country or device.

## Related pages

- [Manage your dashboard team](/docs/guides/dashboard-team)
- [Data isolation between environments](/docs/security/tenant-isolation)