6.8 Security

Administration → Settings → Security. The console security policy: lock-out, network restrictions, sign-in notice, local account use, password re-confirmation, sessions, local password rules, agent enrolment and two client-side rules. Behaviour that used to be fixed in the product is now visible and adjustable here.

The page is split into four groups, selected with the buttons at the top (remembered per browser): Sign-in & access, Sessions, Passwords, Agents & enforcement. One Save bar at the bottom saves all groups together.

Rules that apply to the whole page

• Clamping: the server forces each value into its allowed range. The console can make the policy stricter but never weaker than the built-in floor (for example, passwords never shorter than 8, sessions never longer than 24 hours). After Save, the stored values are shown, so a clamped value is visible at once.
• 0 means off for idle timeout, concurrent sessions, password history, maximum password age, stale-policy days and justification length.
• The defaults reproduce the product’s former fixed behaviour, so upgrading changes nothing until you edit here.
• Saving always asks for your password. Five wrong confirmations within 15 minutes block further confirmations for that user for 15 minutes.
• Auditors can read the page; the cards are locked and the Save bar is hidden.
• Audit event security_config_changed lists every changed section with old and new values.

Sign-in & access

Details:

• Lock-out is counted per user name and client address. The lock is checked before any AD bind, so a locked client cannot hammer the domain controller (and cannot trigger AD account lock-outs through Ada). Failed AD passwords count like local ones. Per address, the sign-in endpoint is additionally rate-limited.
• Console access is checked on every console request, not only at sign-in. A session used from a network outside the list is ended at once (event admin_session_ip_blocked) and must sign in again from an allowed network. A list that excludes the address you are connected from cannot be saved (Your current address (…) is not in the allow-list — saving it would end your session and lock you out.). Agents, add-ins and client endpoints are never affected.
• Manifest access does not affect the Ada add-in panels (Office loads them wherever users are), and Ada’s own server always has access. Client setup on Windows and Mac downloads these manifests, so include every network where setup runs. Blocked downloads are written to the audit log (manifest_ip_blocked) once per address per day. Microsoft 365 fetches a manifest URL from Microsoft’s own servers: with a list here, add the add-ins in Microsoft 365 by uploading the manifest file, not by URL.
• Sign-in notice: the built-in text is not in English. If your users read English, enter your own wording.
• Only when Active Directory is unreachable refuses local accounts while the DC answers (Local accounts can sign in only while Active Directory is unreachable — sign in with your directory account.). When the DC cannot be reached, local accounts work, so you can never lock yourself out. There is deliberately no “never” option. The setting has no effect while AD is disabled.
• Always required, regardless of the ticks: saving this security policy, backup restore, configuration export and import, full backup download, creating or rotating the scheduled-backup key, audit purge, licence install, client-certificate install or import, and restarting the API or web service. With a tick, the server refuses the extra action without your password; the console prompts for it.
• AD administrators confirm with their AD password, which needs the DC. During a directory outage, use a local administrator for these actions.

Sessions

• When the concurrent limit is reached, the oldest session of that user is signed out; a new sign-in is never refused.
• While a console page is open it refreshes counters every minute, and those requests count as activity. The idle timeout therefore ends sessions whose tab was closed or whose computer slept, not an open but unattended tab.
• Sessions are held in server memory. Restarting the API service signs everyone out.

Passwords

Rules for local console passwords. AD accounts follow the domain’s policy.

• The rules apply when a password is set: on the password-setup/reset link page, on Account → Change Password and at a forced change. Existing passwords are not re-checked, except by Maximum age.
• The minimum length and character rules are shown to users on the password pages.
• With Maximum age, a local user whose password is older signs in to the change-password screen and must choose a new password before anything else opens.
• A new Reset link lifetime applies to links issued afterwards.

Agents & enforcement

• Enrolment: each agent enrols with the setup token and receives its own key-bound certificate (one year, renewed automatically 30 days before expiry, re-enrolled automatically with the stored token if a renewal was missed). With approval required, a new machine stays passive (no policy, no commands) until you approve it on Agents; this makes a stolen setup token useless on its own. Agents already registered are not affected. Approval writes agent_approved.
• Strictest means: while stale, the agent requires a label on save, send and print, blocks unlabelled attachments and sets the Outlook send mode to Block. Keep enforcing avoids surprises for travelling users.
• Justification applies to every required justification: downgrading a label, overriding a copy/send block, and rule warnings that require a reason.
• The stale-policy and justification settings travel inside the signed policy. Saving a change re-signs the policy automatically; agents receive it at their next sync. They are enforced by agents 1.3.81 and later on Windows (Office add-ins and desktop classifier), macOS and the Office web add-ins.