VerasolDocs
العربية Open Verasol

Firm security

Require two-factor sign-in for your staff, let them sign in with your Microsoft or Google work accounts, limit how long sessions last and act on a lost phone or a departing accountant.

For Verasol 2.12·5 min read

Firm security sets the sign-in rules for everyone on your firm's staff: two-factor sign-in, single sign-on with your own Microsoft or Google work accounts, and how long a session may last. It also lets you act on one person, for example after a lost phone. Only firm admins can open it.

These rules apply to your firm's staff. The client's own people, who sign in to their own company, are never affected.

Open Firm › Security. The page has four tabs: Rules, Domains, Single sign-on and Staff. Audit export at the top opens the audit export.

Require two-factor sign-in#

With two-factor sign-in, Verasol asks for a 6-digit code from an authenticator app on the person's phone after their password.

The Rules tab: two-factor sign-in, single sign-on and sessions
  1. Turn on two-factor sign-in for yourself first, under Profile › Security (see Your profile). Verasol refuses to require it for the firm until you have it.
  2. On the Rules tab, switch on 1 Require two-factor sign-in for all staff.
  3. Choose the date it is Required from. Until that date, staff are reminded; from that date, they must set it up before they can work. If you leave the date empty, they get 14 days.
  4. Click 5 Save.

2 Accept Microsoft's MFA as the second factor: when your staff sign in through Microsoft Entra ID with multi-factor authentication, that counts as two-factor sign-in.

Set up single sign-on#

With single sign-on, your staff sign in with their work account at Microsoft Entra ID or Google Workspace. Setting it up is usually a task for your IT administrator. The steps are:

  1. Domains: click Add domain and enter the e-mail domain your staff use, like yourfirm.ae. Verasol shows a DNS TXT record: add it at your domain's DNS provider, then click Verify. DNS changes can take up to an hour. Only verified domains can use single sign-on, and a public e-mail domain cannot be used.
  2. Single sign-on: under Add a connection, choose the 1 Provider (Microsoft Entra ID or Google Workspace) and the Button text your staff will see. For Microsoft, enter the 2 Tenant ID; for Google, the Workspace domain. Leave 3 Application (client) ID empty to use Verasol's app, or enter your own app and its Client secret. The box at the top shows the redirect address to register at your identity provider. Click 4 Save.
  3. Click Test on the connection and sign in at the identity provider in the window that opens. Nobody is signed in to Verasol by the test; the result shows what the identity provider sent.
  4. When the test succeeds, click Turn on.
Add a single sign-on connection with Microsoft Entra ID or Google Workspace

For Microsoft Entra ID, you can tick Set the firm role from Microsoft groups and list the groups with the firm role and office each one gives, and a Priority. At each sign-in, the highest-priority matching group sets the person's firm role and office. Firm admins are never set or removed by a group.

Require single sign-on#

Once a connection is on, the Rules tab can switch on 3 Staff must use single sign-on (no password sign-in). Before you do:

  • Choose at least one break-glass admin on the Staff tab (Make break-glass admin, at most 2 firm admins). Break-glass admins can still sign in with their password and two-factor sign-in, for when the identity provider is down.
  • Decide whether to switch on Create staff at their first single sign-on. New people from your verified domains then join the firm at their first sign-in, with the Firm role and Office you choose, and see no clients until someone assigns them.

Session limits#

Under Sessions on the Rules tab:

  • 4 Sign out after idle (minutes): staff are signed out after this many minutes without activity. Leave it empty for the app default of 120 minutes.
  • Maximum session (hours): staff must sign in again after this many hours, even when active. Leave it empty for no limit.

Your staff's sign-in#

The Staff tab lists each person with their Firm role, whether two-factor sign-in (1 2FA) and single sign-on (SSO) are set up, their 2 Last sign-in and the number of devices they are signed in on (Devices).

2 Last sign-in is the last time the person signed in: with a password, Google or Microsoft, single sign-on or an invitation. The line "Active" with a date below it is the last time one of their browser sessions or app connections was used, even without a new sign-in. Point at the column heading to see this explained.

The Staff tab: two-factor sign-in, single sign-on and devices per person

The Actions menu on each row has:

  • Sign out everywhere: signs the person out on every device, for example after a lost laptop or when someone leaves.
  • Reset two-factor sign-in: for a lost phone. You give the reason, which is kept in the audit trail; the person is signed out everywhere and sets up two-factor sign-in again at their next sign-in. You cannot reset your own, and a firm admin's is reset by Verasol support.
  • Make break-glass admin or Remove break-glass, for firm admins.

Every change on this page is recorded in the firm's audit trail.