Settings > Security (/settings/security) holds the sign-in and session rules for the whole workspace. They are enforced on the server for every page and API request, not just hidden in the interface, and every change is written to the audit log.
The controls
- Idle timeout: sign people out after 15 minutes, 30 minutes, 1 hour, 4 hours or 8 hours without activity, or turn it off. A warning appears before the session ends. The default is 1 hour.
- Maximum session age: force a fresh sign-in after a fixed time (from 8 hours up to 30 days) no matter how active the session is.
- Two-factor authentication: require it for everyone, for admins only, or leave it off. People who have not set it up are sent to a setup page before they can continue.
- Allowed sign-in methods: email and password, Google, Microsoft, email magic link or code, and enterprise SSO (SAML or OIDC). Untick any method you do not want used.
- Require SSO: force everyone with an email at your domain (for example @acme.com) to sign in through your identity provider.
- IP allow-list: limit access to listed IPv4 or IPv6 addresses and CIDR ranges, such as your office or VPN egress.
Set up required SSO
- 1Ask Limnn support to connect your identity provider (Okta, Microsoft Entra ID, Google Workspace or any SAML or OIDC provider) as an enterprise connection for your domain.
- 2Open Settings > Security. The SSO section shows the live status of the connection for your domain, or the exact setup steps if none is active yet.
- 3Turn on Require SSO and enter the domain. It can only be saved once the connection is active.
- 4Test with a non-owner account. SSO sessions count as multi-factor, so people are not asked for a second factor on top of their identity provider.
Safety rails
- The workspace owner is never blocked by the IP allow-list, SSO requirement or sign-in method rules, and can always reach Settings > Security to fix a mistake.
- Other admins cannot save an allow-list that excludes the IP address they are using.
- Sign-in pages, public pages such as booking and help-center pages, and incoming webhooks are never blocked by these rules.
Roll out in stages: turn on two-factor for admins first, then everyone; add the IP allow-list only after confirming every office and VPN range. Check /settings/audit after each change.