Settings/Authentication/Policy
Authentication policy
Organization-wide login methods, password policy, MFA, sessions, and access controls.
Allowed login methods
Password policy
Requires uppercase, lowercase, number, special character, and compromised-password detection (local list + HIBP-ready).
MFA requirement
Session controls
Registration & domains
Also supports automatic domain joining, user approval, IP allowlist, country and device restrictions.