Company login settings

Related information

Related topics

• Password policy and requirements
• Cannot log in
• Unlock a user
• Company information

Control who can log in to your company, how they log in, and how long their session lasts.

To change your company security features and settings, go to Company > Setup > Configuration > Company > Security tab, then select Edit.

Timeout settings

Set how long users can stay logged in or remain inactive before Sage Intacct automatically logs them out.

Two timeout types are available:

• Default inactivity duration: On a company-wide level, the admin determines how long all users can remain inactive before they’re automatically logged out. Users receive an alert when one minute remains.
• Default session duration: On a company-wide level, the admin determines how long all users can be logged in for any session before they’re automatically logged out, regardless of their activity. Users receive an alert when one minute remains.

To set a timeout:

1. Set the Default inactivity duration using the hours and minutes dropdowns.
2. Optionally, set a Maximum inactivity duration to cap how long any user can extend their own inactivity setting.
3. Set the Default session duration using the hours and minutes dropdowns.
4. Optionally, set a Maximum session duration to cap how long any user can extend their own session settings.
5. Save your changes.

Timeout alerts

Users receive an in-app alert one minute before a timeout occurs.

Inactivity timeout alert: Users receive an alert one minute before the inactivity duration is reached. Users can select one of three options:

• Stay logged in: The session stays open.
• Log out: The session ends and the login page appears.
• Do nothing: The session ends when the inactivity duration is reached.

Session timeout alert: Users are prompted to save their work. When the session duration ends, they're logged out automatically.

Desktop notifications

If a user switches to another tab or application, timeout alerts can be hidden. Desktop notifications ensure that users see the alert even when Intacct is not the active window.

To enable desktop notifications from your user preferences page:

1. Select the User menuUser circle at the top of any Intacct page and select My preferences.

2. Under Timeout settings, select Enable browser notifications. A browser permission prompt appears.

3. Grant permission. Intacct replaces the link with text: Desktop notifications will appear whenever your session is about to time out.

Desktop notification permissions can also be managed directly in your browser settings. The steps vary by browser. The following example uses Chrome.

To manage notifications in Chrome:

1. Select the three vertical dots in the upper right and select Settings.
2. Select the Privacy and security tab.
3. Select Site settings.
4. In the Permissions section, select Notifications.
5. Scroll to the Customized behaviors section.
6. In the Allowed to send notifications option, select Add.
7. In the Site field, enter intacct.com.
8. Select Add.

Password settings

Customize the password policy for all users in your company. For more information about Intacct password requirements, see Password policy and requirements

Customizable password policy components include:

To set password requirements:

1. For Reset password, select how frequently users must change their passwords. Options range from weekly to yearly.

   If you have an integration or API application that uses an Intacct user ID and password for connectivity, go to Company > Admin > Users and permissions > Users, open the user associated with the integration, and select Keep my password until I reset it on the User information tab. This prevents a scheduled reset from disrupting the connection.

   See Field descriptions: User information and Password policy and requirements for more information.

2. For Minimum length, select the minimum number of characters required for a valid password. The minimum allowed is eight characters.

   Password requirements: Each password must:

   • Contain at least eight characters long AND
   • Contain at least one number, one lowercase letter, one uppercase letter, and one special character.

   For instance, 1$g*1LHd is a strong password. See Password policy and requirements for more information.

3. For Prevent reuse of previous passwords, select the number of recent passwords users cannot reuse. You can require between three and 20 unique passwords before reuse.

4. Save your changes.

Login and reset attempts

Control how many failed login or password reset attempts are allowed before an account is locked.

To set your login and reset attempt settings:

1. For Maximum login attempts per day, select the maximum number of failed login attempts allowed in a 24-hour period. A successful login resets the counter. After this limit is reached, only an administrator can unlock the user.
   After Intacct locks out a user, only an administrator can unlock a user.
2. For Maximum reset attempts per day, select the maximum number of password reset attempts allowed in a 24-hour period. You can set this between 1 and 10.
   When the number of attempts is exceeded for the period, only the administrator can reset the password until the period is over. Then, the user can try again.
3. For Maximum number of verification attempts for a password reset, select the maximum number of times a user can enter incorrect information during a password reset. When this limit is reached, the account is locked for 24 hours.
   
4. Save your changes.

Enforce IP address filters

For extra security, you can enforce IP address filters. Enforcing address filters means only locations with known IP addresses (such as those coming from your corporate office) can be used to log in to your Intacct company. When you enforce IP address filters, any login that does not come from the list of allowed IP addresses is denied, preventing login attempts from unknown locations.

The following enforcement options are available:

To add approved IP addresses:

1. Select the pencil icon in the Enforce IP address filters section.
2. In the IP Address Filter Information window, select Add.

3. Enter an IP address or IP address range.

   • To enter a single address, enter the same IP address in both the Start IP address and End IP address fields.

   • For company-level: Only enter the IP address or address range. Leave the Username field empty.

   • For user-level: Select the Username, and enter the IP address or address range.

     You can add multiple records per user, for example, if a user logs in from two locations, add a separate record for each IP address.

4. Save your changes.

Enable two-step verification

Add an extra layer of security to your account with two-step verification.

You can require users to verify their identity with a code in addition to their username and password. Codes are delivered via an authenticator app, text, or phone call.

Users who regularly log in from a personal device can mark it as a trusted device to skip the verification step in the future. To prevent this, see the Do not allow trusted devices option below. For more information, go to Set up two-step verification.

To enable two-step verification:

1. Select the Enable 2-step verification checkbox.
2. Select which users must enter a verification code:

   Verification options

   Field	Description
   Selected users	Select if you want to require verification for only selected users. To enable 2-step verification for selected users, go to Company and select Users. Then, select Edit and enable 2-step verification for each user.
   All users	Select if all users must enter a verification code.

3. Optionally, select Do not allow trusted devices to require a verification code on every login, even from previously trusted devices. When this is enabled, users cannot bypass the verification step.
4. Save your changes. Users receive an email notification when 2-step verification is enabled for their company.

Passkey authentication

Allow users to sign in with a passkey, which is a device-based method that uses a biometric or a PIN instead of a password. Passkeys are phishing-resistant and work alongside your existing login settings without requiring any changes to your password or two-step verification configuration.

When a user signs in with a passkey, they are not prompted for a two-step verification code, even if two-step verification is enabled for your company. If they sign in with their password instead, two-step verification applies as usual.

To enable passkey authentication:

1. Select the Enable passkey authentication checkbox.

2. Save your changes.

Once enabled, users can register their devices and sign in with a passkey from My preferences > Security > Passkey Authentication. For more information, see Passkey authentication.

To disable passkey authentication for your company, clear the checkbox and save. Users with registered passkeys will not be able to use them while this setting is off.

Field descriptions