Skip to main content

Configure security and SSO

Administrators and the Owner manage organization security in Organization settings > Security. These policies control access to the organization. Coordinate changes with the people responsible for sign-in and network access so members can still connect through the intended route.

Require two-factor authentication​

  1. Open Two-factor authentication > Manage.
  2. Enable Enforce 2FA.
  3. Click Validate.
  4. Check that a password-signing member without two-factor authentication is directed to the required setup.

To change this requirement, your account must have two-factor authentication enabled or you must be using an SSO session. Merely having SSO linked to your account does not make a current password session an SSO session.

For password access, members configure their own two-factor authentication. Boldo does not impose a second Boldo two-factor step on an SSO session; authentication requirements at the identity provider must be configured there.

Set session duration​

  1. Open Session duration > Manage.
  2. Select Default (7 days) or an available duration: 1, 3, 14, 30 or 60 days.
  3. Click Validate.
  4. Inform affected members if the change can make them sign in sooner.

For members of several organizations, the shortest applicable duration takes precedence. An organization with no custom setting contributes the seven-day default. Choosing 30 days in one organization therefore does not override a shorter requirement elsewhere.

Shortening the duration can shorten existing sessions immediately. Increasing it does not directly extend every already-open session; extension occurs through session renewal. This setting is a session lifetime, not a timer that measures uninterrupted editing activity.

Restrict allowed IP addresses​

The IP whitelist section depends on your plan. Use the public addresses from which Boldo receives requests, including any organization VPN or proxy egress addresses.

  1. Open IP whitelist > Manage and enable the restriction.
  2. Choose Add an IP address or Add my IP.
  3. Enter an IPv4 address or IPv4 range with its CIDR prefix, and an optional description of at most 50 characters.
  4. Keep your current public IP, or a range containing it, in the list.
  5. Click Validate.
  6. Check access from an allowed network and the intended refusal from a different network.

IPv6 is not accepted by this form. A private address assigned to your laptop is not necessarily the address Boldo sees; Add my IP helps identify the current address.

Keep the current address when saving

Boldo refuses a saved list that excludes your current public IP. This check also applies when disabling the restriction. Turn the switch off while keeping a valid current-address entry; do not empty the list as a way to disable it.

An optional exception for external sharing links is configured separately under sharing administration. It does not let members open the normal application from disallowed addresses. API and MCP access also have their own connection requirements.

Coordinate single sign-on​

Single sign-on setup is coordinated with Boldo and your identity-provider administrator. The Security page does not contain a self-service SAML or OpenID Connect setup wizard.

  1. Identify the organization and the professional domain members will enter for SSO.
  2. Agree with Boldo on the provider and supported protocol for your deployment.
  3. Obtain the exact provider configuration values for that deployment, then configure the application in your identity provider.
  4. Test a permitted identity, organization access, assigned user type and roles.
  5. Agree on recovery and administrator access with Boldo and the identity-provider administrator before requiring SSO.
  6. Validate the SSO requirement and repeat the member sign-in check.

Do not reuse callback URLs, entity identifiers or certificate settings from another organization without confirmation. Use the supplied deployment-specific values. Members then follow SSO sign-in, entering their professional domain before redirection to the identity provider.

A new arrival receives Administrator type only if no existing organization member yet has an account with that SSO provider. Otherwise, the new arrival becomes a Viewer. Existing members are not automatically reassigned by this provisioning path. Review types and roles after onboarding rather than assuming identity-provider login grants business editing rights.

An SSO-required organization rejects password access and email/password invitations. The effective session must use its expected provider. A previously disabled sign-in method is not automatically reactivated by signing in again.

A Boldo password is therefore not a universal fallback when SSO is required. Document and test the agreed recovery route with the provider administrator and Boldo support.