Security Controls
Require two-factor authentication for your team, set up single sign-on, and review the audit log.
Security Controls
Owners and admins have three extra sections under the Organization group in Settings. Use them to require two-factor authentication (2FA), set up single sign-on (SSO), and see who did what.
| Section | What it does |
|---|---|
| Organization Security | Require every member to use 2FA, and see who has set it up |
| Enterprise SSO | Let members sign in with your company's identity provider |
| Audit Log | A permanent record of security and admin events |
Note
To change the 2FA policy or SSO domains, your own session must be verified with 2FA. If it is not, set up 2FA in Security, then sign out and back in with your authenticator.
How to require 2FA for your organization
- Open Settings and choose Organization Security.
- If you belong to more than one organization, pick it under Organization.
- Turn on Require multi-factor authentication.
- Set the Grace period in days (0 to 90). This is how long members have to set up 2FA before they are blocked. Use 0 to enforce it right away.
- Click Save policy.
Once the grace period ends, members without 2FA must set it up and enter a code each session before they can use the organization's data.
Check who is compliant
Member MFA enrollment shows how many people are Enrolled and Compliant. Each member is marked Compliant or Out of policy.
How to set up single sign-on
SSO lets your team sign in with their work account (for example Okta, Microsoft Entra ID or Google Workspace) instead of a Cothon password. Cothon supports SAML.
After that, members click Sign in with SSO (enterprise) on the sign-in page and enter their work email.
Tip
Contact Cothon when you request a domain, so we can set up the provider with your IT team.
How to review the audit log
The Audit Log records sign-in and security events, membership changes, data exports and other admin actions. Entries cannot be edited or deleted.
- Open Settings → Audit Log and pick your Organization.
- Narrow the list with Filters: Category, Event type, Outcome, Actor email contains, and a From and To date.
- Click a row to see details such as the IP address and request ID.
- Click Export CSV to download the filtered list.
Related pages
- Security: set up your own 2FA
- Roles
- Authentication
Related Articles
Was this page helpful?