Security, SSO, and MFA
Security settings define how users access the Owner App and how the Company reduces account takeover risk. They complement Users & Roles: roles decide what a user can do after login; security settings decide how access is authenticated and governed.
Use Cases
| Use Case |
|---|
| -> Require MFA for all Owner App users. |
| -> Configure SSO so employees authenticate with the Company's identity provider. |
| -> Enforce password complexity and expiration policies. |
| -> Automatically block users who have been inactive for too long. |
| -> End idle sessions after a defined period. |
Security controls
| Control | Purpose |
|---|---|
| Password policy | Defines password complexity, renewal, and reuse restrictions. |
| Sign-in policy | Controls login restrictions and allowed authentication behavior. |
| MFA | Requires a second factor when users sign in. |
| SSO | Delegates authentication to the Company's identity provider. |
| Idle timeout | Ends sessions after inactivity. |
| Inactive-user block | Blocks users who have not accessed the platform for a configured period. |
SSO
Single Sign-On is used when the Company wants employees to access Loyal Guru through its corporate identity provider.
Before enabling SSO, confirm:
- Identity provider type and metadata are available.
- User email or login identifier matches the Owner App user.
- Admin fallback access exists for support and emergency operations.
- Role assignments are already configured in Loyal Guru.
SSO controls authentication only. It does not replace Owner App roles or role groups.
For the full SAML setup (authentication models, IdP configuration, Azure AD Attributes & Claims, testing, and hardening), see SSO Configuration.
MFA
Multi-Factor Authentication adds a second verification step during login. It is recommended for Admins and users with access to personal data, exports, configuration, or campaign sending permissions.
Configuration
Security settings are managed from the Company security configuration area. If the option is not visible, check whether the module is enabled and whether the current user has Admin/security permissions.