Access policies
Workspace-wide sign-in rules set by the owner: require two-factor authentication, allow only certain networks (API keys included), and sign people out after inactivity or a fixed time.
Access policies are sign-in rules for everyone in the workspace: require two-factor authentication, let the workspace be opened only from your office network, and sign people out after a while. They are checked every time anyone opens anything in the workspace.
Before you start: only the owner sets access policies. Everyone else sees "Only the workspace owner sets security policies. They apply to everyone, including you." Saving asks you to have signed in recently; if it has been a while, AxisIQ asks you to confirm it is you. If you don't see this yet, the owner applies the waiting workspace upgrade — see Upgrade your workspace.
Open Access policies
Open Settings (workspace name menu → Organization settings) and click Access policies in the left rail.
Require two-factor authentication
Turn on Require two-factor authentication. Everyone must then use an authenticator app to open this workspace. See Two-factor authentication.
Allowed networks
Under Addresses and ranges, list the internet addresses that may open the workspace, one per line — a single address such as 203.0.113.7, or a range such as 203.0.113.0/24. Leave it empty to allow any network.
- The page shows Your current address; click Add my address to add it.
- The rule covers access keys used by your integrations too. Add the addresses your integrations call from, or they will be refused.
Session limits
- Sign out after inactivity — Off, or 15 minutes up to 24 hours without activity.
- Sign in again every — Off, or 8 hours up to 30 days, however active the person is.
Click Save policies. You see "Security policies saved".
You cannot lock yourself out
AxisIQ refuses a save that would shut the owner out — for example, requiring two-factor when you have not set up an authenticator app yourself, or an address list that leaves out the address you are using now. Fix that first, then save.
What people see when a rule turns them away
Instead of the workspace, they see a page that says why and what to do next:
| They see | What to do |
|---|---|
| Two-factor authentication required | Set up two-factor takes them to their account to add an authenticator app. |
| This network is not allowed | Connect from an allowed network, then Try again. |
| Your session timed out | Sign in again. |
Each also offers Switch workspace, since the rules belong to this workspace only. Their other workspaces are not affected.
Good to know
- Every change to the policies is recorded in the audit log.
- A chat or live connection that was already open before a change can stay open until it reconnects.
- The rules are not yet applied to Ask Axis on WhatsApp or to publishing a site from git.