Security: MFA, SSO and policies

This is where you decide how people get into Orquiva: with two-step verification, with your identity provider’s account (SSO), and with which passwords.

Before you start

Not everything is on every plan:

Setting	Plan	Where
Your own two-step verification	All	Profile menu › Preferences
Requiring MFA company-wide and resetting other people's	Enterprise	Organization › Security › MFA
SSO (Google, Microsoft, OIDC)	All	Integrations › Single Sign-On
Password policy	Professional and Enterprise	Organization › Security › Password policy

The company screens are open to the Admin role or anyone with the MFA permission, which unlocks all three.

Your own two-step verification

Anyone can turn it on, whatever the plan:

To remove it, enter your current password and click Turn off. If your company requires it, it can’t be turned off. What each employee sees is in Security and password.

Require MFA for the whole company

OrganizationSecurityMFA

Anyone who doesn’t have it yet will see a QR code at their next login and must set it up to get in.

Under Manage users you search for a person by name and use Regenerate secret (they’ll scan a new QR code at their next login), Disable MFA or Enable MFA. That’s the way out when someone loses their phone.

Enable MFA and Regenerate secret leave two-step verification required for that person: sign-in asks them for the code (or the QR code, if they haven’t set it up yet) and they can’t turn it off from their Preferences. Only Disable MFA lifts it.

Single sign-on (SSO)

IntegrationsSingle Sign-On

Google and Microsoft each have a switch: Enable SSO with Google and Enable SSO with Microsoft. Microsoft accepts work accounts (Microsoft 365) and personal ones (Outlook, Hotmail). For each one you can fill in Auto-provision emails from this domain: anyone signing in for the first time with an email from that domain is added automatically. Left empty, only people who already have an account get in. Finish with Save changes.

For Okta, Entra ID, Keycloak or any OpenID Connect provider, go to Other providers (OIDC):

SAML is not available.

Password policy

OrganizationSecurityPassword policy

Out of the box it asks for 8 to 128 characters, with uppercase, lowercase and numbers, and no required symbols. You can set the length anywhere from 1 to 256 characters; if you go outside that range, Orquiva adjusts it. Check or uncheck Uppercase, Lowercase, Numbers and Symbols, look at the Preview and click Save.

What happens next

The policy is checked every time someone sets or changes a password. It doesn’t force existing passwords to change, and Orquiva doesn’t expire passwords.

The two-step verification code is asked for when signing in with a password. Anyone signing in through SSO is identified by their provider, and the second factor is that provider’s to require.

MFA and password policy changes are recorded in the Security tab of the Audit log.

If something goes wrong

I don’t see the option to require MFA for the whole company. It’s an Enterprise feature. See Billing, plan and modules.

Someone lost their phone and can’t get in. On Enterprise, use Regenerate secret or Disable MFA under Manage users. On other plans there’s no screen for it: contact Orquiva support.

It won’t let me force SSO. No admin has signed in through that provider yet. Sign in once with it and try again.

I’m looking for SAML. It doesn’t exist. If your provider speaks OpenID Connect, use Other providers (OIDC).