CRM-NG

Enterprise

Passkeys, two-step sign-in and lockouts, set by role.

Decide how each role signs in, help people enrol, and stop password guessing before it gets anywhere.

Join the betaBack to Enterprise
Security settings: which sign-in methods are allowed and which roles must use two-step verification.
Security settings: which sign-in methods are allowed and which roles must use two-step verification.

Why it matters

Most break-ins start with a reused or phished password. Turning on two-step sign-in for a whole team is daunting: people lose phones, someone gets locked out on a Monday morning, and the easy fix is to switch protection off again.

Sign-in security in detail

  • Sign-in methods

    Choose what people may use as their second step.

    • Passkeys and FIDO2 security keys
    • Authenticator apps and email codes
    • Backup codes to copy, print or download

  • Policies by role

    Each role gets its own requirement.

    • None, any second factor, or passkey required
    • Grace period to set up
    • Trusted devices for a set number of days

  • Brute-force protection

    Failed sign-ins are counted and acted on.

    • Per IP address and per account
    • Lockouts and site-wide IP bans
    • Allowlist with CIDR ranges

  • People screen

    See everyone with CRM access and their sign-in status.

    • Search by name or email, filter by role
    • Who is due or overdue to set up
    • Open a person for their Login Security

Questions

Why are passkeys called phishing-resistant?

A passkey only works on the real sign-in address it was created for, so a look-alike page cannot capture it the way it can capture a typed password or code.

Can we stop password resets by email for passkey users?

Yes. Password reset by email can be limited so people who have a passkey or security key cannot be taken over through their inbox.

Can a passkey made on one address be used on another?

No. A passkey is tied to the sign-in address it was created on, so a passkey for one site will not work on a staging copy or another hostname.

More about Enterprise

See Enterprise running on your own data.

Every module runs on CRM-NextGen Cloud: we set it up and run it for you. Beta members get the first invites and hear pricing first.

Join the beta