# Organization session and MFA policies

The `keenauth_session_policy` and `keenauth_mfa_policy` resources set an organization's own session lifetimes and multi-factor rules. An organization policy can only be stricter than the environment setting (`keenauth_environment_settings`). A looser value fails with `422 policy_weaker_than_parent`.

```terraform
resource "keenauth_session_policy" "acme" {
  organization_id   = keenauth_organization.acme.id
  idle_minutes      = 60
  absolute_minutes  = 720
  refresh_idle_days = 7
}

resource "keenauth_mfa_policy" "acme" {
  organization_id       = keenauth_organization.acme.id
  required_for          = "admins"
  allowed_factors       = ["webauthn", "totp"]
  enrollment_grace_days = 7
}
```

## Session policy

| Attribute | Range | Description |
|---|---|---|
| `idle_minutes` | 5–144000 | Session idle timeout. At most `absolute_minutes`. |
| `absolute_minutes` | 60–525600 | Absolute session lifetime. |
| `refresh_idle_days` | 1–365 | Refresh token idle lifetime. At most `refresh_absolute_days`. |
| `refresh_absolute_days` | 1–365 | Absolute refresh token lifetime. |

- Set at least one attribute. An attribute you leave out is inherited from the environment.
- Shortening a lifetime ends the organization context of existing sessions.
- The session policy needs the Enterprise plan (`403 plan_feature_unavailable`). It is open in development environments.

## MFA policy

| Attribute | Values | Description |
|---|---|---|
| `required_for` | `none`, `admins`, `all` | Who must use a second factor. `admins` covers organization administrator roles and members with `idp_` system permissions. |
| `allowed_factors` | `totp`, `webauthn`, `sms`, `email` | Second factors members may use. At least one; each must be enabled in the environment. |
| `enrollment_grace_days` | 0–30 | Days a member may sign in before enrolling a required factor. Defaults to `0`. |

## Lifecycle

- An organization has one policy of each kind. The resource ID is the organization ID.
- Every write sends the complete policy. A create does not overwrite an existing policy: if the organization already has one (set in the dashboard or the Admin Portal), the API answers `428` and you import it instead.
- Updates and deletes send `If-Match`. A policy changed outside the provider shows up as drift in the next `plan`; a policy deleted outside the provider is created again.
- Removing the resource deletes the policy, and the organization inherits the environment setting again.

## Import

Import with the organization ID:

```shell
tofu import keenauth_session_policy.acme org_01j9zq3v8c5m2x7k4t6r1n0b3d
tofu import keenauth_mfa_policy.acme org_01j9zq3v8c5m2x7k4t6r1n0b3d
```