Security Settings

Settings › Security controls how people sign in to mxHERO. The mxHERO Dashboard card sets the sign-in methods and two-factor authentication for the Admin Dashboard. The mxHERO End User Application card sets the sign-in methods, session length and message visibility for employees using the End User App.

Before you begin

• You need an Owner or Administrator user.
• Saving the mxHERO Dashboard card asks you to authenticate again if your last sign-in was more than 1 hour ago.
• Before you turn off a sign-in method, make sure every dashboard user, including you, can sign in another way. Check the ACCESS column on Settings › Users.

mxHERO Dashboard

At least one of the four sign-in methods must be on.

Change the dashboard sign-in options

1. Open Settings › Security.
2. On the mxHERO Dashboard card, turn the methods you want on or off.
3. Turn Two-factor authentication (2FA) on or off.
4. Click Save Settings.
5. If the Authentication required dialog opens, authenticate again.

Changes apply the next time users sign in.

Important: If you turn on SAML and it is the only method, the sign-in page sends every user straight to your identity provider. Test SAML with a second method still on before you turn the others off.

How 2FA works

• The code is sent from noreply@mxhero.com to the user's dashboard email address.
• The code is valid for 10 minutes. Users have 10 attempts.
• Users can trust a browser for 7 days, so they aren't asked for a code there again during that time.
• When mxHERO asks a user to authenticate again before a sensitive change, a user with 2FA only enters a new code.

See Registering and signing in for what users see.

mxHERO End User Application

These settings apply to the End User App (https://app.mxhero.com), where employees manage held messages, approval requests and their mxHERO Shares files.

Available login options

Choose which methods employees can use to sign in to the End User App. Select at least one:

• Send code by email: the employee enters their email address and receives a sign-in code.
• Google Sign-In: the employee signs in with a Google account matching their email.
• Microsoft Sign-In: the employee signs in with a Microsoft account matching their email.

Session duration

Session duration in hours sets how long employees stay signed in before they must sign in again. Enter a whole number from 1 to 48 (2 days). Select No expiration to keep employees signed in until they sign out.

Note: No expiration keeps a session open on any device the employee used, including shared computers. Prefer a set duration unless your users need otherwise.

Temporary hold permissions and Request approval permissions

Message visibility controls which held messages (Temporary Hold) and approval requests (Request Approval) each employee sees in the End User App, now and in the history. Set each one separately.

A user's "team" includes the groups and shared mailboxes they belong to.

These options affect what employees see. Owners and Administrators with the matching admin-view permission can still see all items in the admin view. See Users and roles.

Save the End User App settings

1. Make your changes on the mxHERO End User Application card.
2. Click Save settings at the bottom of the card.

Verify

• Sign out of the dashboard, enter your email on the sign-in page, and check that the methods you enabled are offered.
• With 2FA on, sign in from a new browser and check that a code arrives.
• Open https://app.mxhero.com, enter an employee's email address, and check that the End User App offers the login options you selected.

• Changes are recorded in Reports › User Activity.

Troubleshooting

Related pages

• Registering and signing in
• Users and roles
• Single sign-on with SAML
• The End User App
• Temporary Hold
• Request Approval