Administrator

Buzz applies the strictest password-policy requirements that apply to each user.

The General policy establishes the baseline for the domain. Students always use the General policy, and Administrators, Teachers, and Observers cannot have role-specific requirements that are less strict than General.

Additional minimums can also apply:

• Agilix minimums: Agilix sets minimum security requirements for some administrators, teachers, and observers. If a role-specific policy is less strict than the Agilix minimum, the Agilix requirement is enforced.
• Base-domain minimums: Password-policy requirements inherited from a base domain act as minimums for subdomains. Subdomain administrators can make those requirements stricter, but cannot relax them.
• Multiple roles: If a user has more than one role classification, Buzz applies the strictest requirements from all applicable role policies.

In general, password policies can always be made more secure, but they cannot be configured below an applicable General, inherited, or Agilix minimum.

To configure any of the Password policies for your domain:

1. Open Domain Settings.

Policies and enforcement appear to users in the Change password screen.

As part of each password policy, you can control when users are locked out of their account, how lockouts work, if and when passwords expire, and how often users can reuse a previously used password.

You are asked to define:

1. The Number of unsuccessful login attempts before lockout. This number must be between 1 -100.
2. The number of Minutes until lockout expires.
   • By default, lockouts don't expire, meaning admins must override them.
   • If you enter a number, it must be a positive, whole number.
3. The number of Days until passwords expire. By default, passwords don't expire.
4. The number of Days to wait before you can reuse a password. By default, there is no wait.
5. The number of Days to wait before locking out stale accounts (accounts without login). By default, there is no lockout for stale accounts.

Your Volatile password-strength settings are intended to help users secure their accounts. These are called volatile because future events can occur, making previously secure passwords no longer secure.

You are able to specify:

1. The Minimum-allowed password strength (entropy). This is a numeric measure of how easily a password can be discovered in an attack; the greater the entropy number, the stronger the password. A strength of 64 or higher is recommended. Click Help me choose to learn more.
   • Agilix enforces the following minimums: Admins - 40, Teachers - 36, Observers - 32
2. Any Domain-specific words that weaken password strength. Here you can enter terms that users might be tempted to use, but would weaken the password (e.g., the name of the platform or the name of their school).
3. The action you want Buzz to take when users have passwords that don't conform with your Volatile password-strength settings. Options include combinations of warnings or requirements users get when logging in or changing passwords:
   • None
   • Warn on password change
   • Require on password change
   • Warn on login and require on password change
   • Require on login and require on password change - Agilix sets this enforcement automatically for admins and teachers
4. The desired level of Reject known-breached password enforcement. If the password appears in a database of compromised passwords, Buzz can be set up to take any of the following actions:
   • None
   • Warn on password change
   • Require on password change
   • Warn on login and require on password change
   • Require on login and require on password change - Agilix sets this enforcement automatically for admins and teachers

Your Basic password-strength settings include:

1. The Minimum password length in characters. This number must be between 1-100
2. The Minimum character classes used, up to four (a-z, A-Z, 0-9, other).
3. The action you want Buzz to take when users have passwords that don't conform with your Basic password-strength settings. Options include combinations of warnings or requirements users get when logging in or changing passwords:
   • None
   • Warn on password change
   • Require on password change
   • Warn on login and require on password change
   • Require on login and require on password change

Multi-factor authentication provides an additional layer of security for users by requiring them to use a second device with an authentication app to log into their account. You can set one of the following Enforcement actions you want Buzz to take if users haven't set up multi-factor authentication:

• None
• Recommend on login
• Require on login

How do I enable multi-factor authentication (MFA) login for users?