Password management for Regular users

Regular users can always change their own passwords: On their profile page, users can click the down arrow on the right of the page header to open the Page Controls and find the Change password link.

Regular users can reset their own password if they forget it: The forms login page has a Forgot password link that Regular users can use should they forget their passwords. This will send them an email with a link that allows them to reset the password. There is no need for administrator intervention.

Note: Regular user passwords will never expire. 

Password requirements

Password requirements are enabled by default for Regular users. This means that administrators and users can only set passwords that meet the minimum password requirements. All passwords must contain the following:

• at least 8 characters
• at least one lowercase letter
• at least one number or special character
• at least one uppercase letter

Change password requirements for Regular users

1. Go to the Admin panel: Users & security section > Regular user settings & invitations page.
2. Under Passwords and security set the checkbox "Require strong passwords for regular users" to the desired value.
   
   
   
   
3. Click Save.

Password lockout

You can configure the password lockout for failed password attempts. This will lockout any Regular user account for a specified period of time after a configured number of failed password attempts.

Configure password lockout for Regular users

1. Go to the Admin panel: Users & security section > Regular user settings & invitations page.
2. Under Passwords and security, enter the desired values in the corresponding fields for Number of password attempts before users are locked out and Number of minutes that the lockout period lasts.
   
   
   
   
3. Click Save.

Added security with two-factor authentication

You can add an extra layer of security for Regular users by enabling optional or required two-factor authentication on intranet login. To learn more, see Two-factor authentication (2FA) for admins.