> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and sign-in settings in the Didit Console

> Require two-factor for every member, restrict console access to an IP allowlist, set session length and verify your email domains in the Didit Console.

Didit's **Security and sign-in** settings control how the members of your organization sign in to the console.
Open them from **Settings > Organization > Security and sign-in**.
The page has five sections: **SSO and SAML**, **Two-factor**, **Session length**, **IP allowlist** and **Verified domains**.

## Two-factor

The **Two-factor** section shows how many members use an authenticator app or a passkey, and whether your organization requires it.
Select **Require two-factor** to make it mandatory for everyone.

* A member who has not set it up is asked to add it at the next sign-in and cannot continue until they do.
* Everyone else keeps access.
* Select **Stop requiring** to let members sign in with a password alone again.

Under **Confirm sensitive actions**, billing changes, API key rotation and role edits ask for two-factor again.

## Session length

**Session length** sets how long a sign-in stays valid.
Use **Stay signed in for** to choose the period after which members sign in again, and **Sign out when idle** to end a session after a number of minutes without activity.

**Sign out all other sessions** ends every other session of the members at once, on every device.
Your own session stays signed in, and members sign in again with SSO, a passkey or their password.

## IP allowlist

**IP allowlist** limits the console to the addresses you list.
Add a single IP address or a CIDR range, with an optional label such as the office name.
The API is not affected: this setting restricts console sign-in only.

Your own address must stay on the list, so add it before you turn the restriction on.
**Browser IP address** shows the address used at your last sign-in or session refresh.

## Verified domains

**Verified domains** proves that you own an email domain.
Add the domain, add the DNS TXT record the console shows at your DNS provider, then select **Verify domain**.
DNS can take up to an hour to be seen.

People can sign in through single sign-on only if their email domain is verified.
Removing the last verified domain turns off SSO for the organization.

## SSO and SAML

Company single sign-on (SAML) and SCIM provisioning are included in the **Enterprise** plan.
For plan details, see [Pricing](https://docs.didit.me/getting-started/pricing.md).

## Permissions

These settings need access to the organization's security settings.
Manage who has it in [Roles and permissions](https://docs.didit.me/console/roles-permissions.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.