> ## Documentation Index > Fetch the complete documentation index at: https://documentation.kodelabs.com/llms.txt > Use this file to discover all available pages before exploring further. # Security Settings > Configure MFA, password policies, and session timeouts Security settings give administrators control over authentication, password policies, and session behavior. All configuration lives under `Security Settings`. ## Configuration Authentication & Security covers three areas—MFA, Password, and Timeout Settings. Each area groups related controls that you can configure independently. Multi-factor authentication (MFA) adds a second layer of verification beyond a password. You can choose whether to enforce MFA for your organization and configure how frequently users verify their identity. MFA settings showing enforcement options and frequency choices including every login, 7-day remember, and 30-day remember ### Enforcement MFA is optional for all users. Requires MFA for all users who sign in with an email address and password. SSO users follow their identity provider's MFA policies. ### Frequency Options Select which frequency options are available to users. Users choose how often they're prompted for MFA during login based on the options you enable. Users verify their identity on every login. Highest level of security. Users aren't prompted for MFA again for 7 days on a recognized device. Users aren't prompted for MFA again for 30 days on a recognized device. Password settings let you define complexity requirements, configure lockout behavior after failed login attempts, and set additional password management rules. Password settings showing Medium complexity selected with requirements, lockout settings of 1 hour and 3 retries, and password history and expiration toggles ### Password Complexity Passwords must be at least 8 characters and include 1 digit, 1 uppercase letter, 1 lowercase letter, and 1 special character. KODE also rejects commonly used passwords. Passwords must be at least 12 characters and include 1 digit, 1 uppercase letter, 1 lowercase letter, and 1 special character. High complexity also disallows consecutive characters. Define your own complexity rules to match your organization's security policies. Custom rules can include lowercase requirements and non-consecutive character rules. ### Lockout Settings How long an account stays locked after reaching the maximum failed login attempts. Defaults to `1`. The unit of time for the lockout duration. Defaults to `Hours`. The number of failed login attempts allowed before the account locks. Defaults to `3`. ### Password Configuration When enabled, users can't reuse recent passwords. When enabled, passwords expire after a set number of days. Defaults to `90` days. Timeout settings control how long user sessions remain active before requiring sign-in again. Timeout settings showing session timeout of 14 days and idle timeout of 1 day How long a session can stay active before the user is automatically signed out. Defaults to `14` days. How long a session can stay idle before it's automatically terminated. Defaults to `1` day.