Update User Security Policy

To ensure user login security, the platform supports setting user security policies, including password security, user disablement, user locking, user notification, and access control policies. Enhance the security of user passwords and reduce the risk of malicious attacks.

Steps

1. In the left navigation bar, click on User Role Management > User Security Policy.

2. Click on Update at the top right of the page.

3. Refer to the following instructions to update the user security policy.

   Instructions:

   • Check the checkbox before the policy to enable it. After a successful update, the rules stated in the policy will take effect. Unchecking the checkbox will disable the policy.

   • Disabling a policy will not clear the configured policy data. When the policy is re-enabled, the configuration data before disabling will be restored.

   Policy	Description
   User Authentication Policy	When users log in using their account password, they can receive a verification code for dual authentication using a specified notification method. Note: The platform supports various types of notification servers, such as Enterprise Communication Tool Server. Please refer to the Notification Server documentation for configuration before selecting the corresponding notification method on this page.
   Password Security Policy	First Login Password Change: Whether new users need to change their password when first logging into the platform. After enabling the policy, new users will be required to change their password on the login page during their first login. Regular Password Change: When a user’s password usage exceeds a set value, they need to change their password; otherwise, they cannot log in to the platform normally. Using 90 days as an example, after the policy takes effect, users need to reset their password if it has been used for more than 90 days.
   User Disablement Policy	Non-Login Period: Users who have not logged into the platform within a specified period will be disabled.
   User Locking Policy	Consecutive Login Failure Count: When a user accumulates a set number of consecutive login failures within 24 hours due to incorrect username/password input, their account will be locked. User Locking Time: The duration of being in a Locked state after being locked due to consecutive login failures, in minutes. During this lockout period, users cannot log in to the platform. The account will automatically unlock after surpassing the lockout time.
   Notification Policy	Send Password via Email After User Creation: Whether to send the password to users via email when they are created successfully.
   Access Control	Note: This policy takes effect on the condition that the policy is updated and will only be valid for newly logged in platform users. Inactive Session Timeout: If an online user does not respond (no interaction) within a set time range, their session will automatically end, and they will be prompted to log in again. Maximum Platform Online Users: The maximum number of users allowed to be online simultaneously. After enabling the policy, when the number of users online equals the set value, any additional user trying to log in will be unable to do so and will receive a System busy, please try again later message. Close all product tabs to end the session: Whether to automatically end the session after closing all product tabs on the browser. Note: This feature depends on the browser’s session mechanism. Tabs restored through the browser’s restore function after closing the page do not support this scenario, nor do tabs restored using shortcut Command + Shift + T. Prevent User from Repeated Login: Whether to prevent users from logging into the platform with the same client at the same time. Once enabled, only one account is allowed to be logged in on one client at a time, and only the last logged-in account is allowed online; only one account is allowed to log in to the platform on one client at a time, and only the last logged-in client is allowed access to the platform.

4. Click on Update.