Skip to main content
Admins use Admin → Security (/admin/security) to review sign-in activity and unlock accounts. Staff manage their own MFA from Profile.

​
MFA (required for password sign-in)

Until DOE Single Sign-On is available, password sign-in requires authenticator MFA. After sign-in without MFA enrolled, you are limited to Profile until you complete enrollment.
  1. Sign in with your DOE email and password
  2. Enter the 6-digit code from your authenticator app (or enroll on Profile if prompted)
  3. Keep the authenticator app available — if you lose the device, ask an Admin to reset MFA, then re-enroll from Profile
Microsoft SSO (when enabled) does not force app TOTP; DOE Conditional Access covers those accounts.

​
Sessions

Idle sign-out does not replace the 12-hour JWT. The idle prompt is a client-side check (default 15 minutes of inactivity). A session can last up to 12 hours if the user stays active; after that the JWT expires regardless of idle settings.

​
Admin → Security

Open Admin → Security to:
  • Filter auth events (bad password, unknown user, bad MFA, lock/unlock, MFA disabled/enabled, user created, successful sign-in)
  • See counts for failures, MFA failures, successes, and currently locked accounts
  • Unlock a locked account immediately
Events store email, time, IP, and reason — never passwords.

​
Account lockout

After 8 failed password or MFA attempts, the account is locked for about 30 minutes.
  • Sign-in shows a clear locked message
  • Admins unlock from Admin → Security or Users → Security → Unlock account
  • Lockouts and unlocks appear in the security event log; notification recipients can get an email when an account locks

​
Email alerts

When email notifications are configured, Admins / recipients can be notified for:

​
User recovery (Admin)

From Admin → Users (/admin/users):
  • Toggle MFA Enabled on the user edit modal, security dialog, or row action menu
  • When MFA is disabled, that account skips the authenticator challenge at sign-in (testing/QA). A red MFA Disabled badge appears on the user, and an audit event is logged
  • Reset MFA clears the authenticator enrollment so the user can re-enroll from Profile (does not by itself skip MFA at login)
  • Reset password (forces change on next login)
  • Force / clear password change
  • Unlock a locked account
Re-enable MFA when testing is done. Existing authenticator enrollment is kept across the bypass toggle and applies again on the next password sign-in. See also User roles and Data Lead tools.

​
Platform protections (production)

These run outside the app UI:
  • New York State geo wall — visitors outside NY see a blocked page (cron/sync/health bypass)
  • Vercel Firewall — rate limit on /api/auth; challenge on /auth/signin; NY-only deny rule
Staff do not configure these day to day; Admins should still review Admin → Security weekly for unexpected sign-in attempts.