ℹ️ Info
Part of the Getting Started guide, Before you begin.
Password rules and two-factor authentication protect members who sign in with a password. Both are under Settings → Access Controls (in Identity & access), in the Password policy section.
📝 Note
Neither applies to members who sign in with single sign-on. When Require single sign-on is on, revel8 greys out both settings.
1. Set password requirements
Open Settings → Access Controls and scroll to Password policy.
On the Password requirements card, switch on the rules you want.
Click Save Password Policy. The button becomes active once you change a rule.
The rules apply the next time a member sets or changes their password.
Rule | What it enforces |
Password expiration | Members reset their password after a set number of days. Enter the number in Expire after (days), at least 1. |
Minimum length | Passwords need at least as many characters as you enter in Minimum characters. |
Require uppercase letters | At least one uppercase letter (A-Z). |
Require lowercase letters | At least one lowercase letter (a-z). |
Require numbers | At least one digit (0-9). |
Require special characters | At least one symbol, such as ! @ # $. |
2. Require two-factor authentication
In the same section, find the Two factor authentication card.
Switch on Require one-time password (OTP) for all members. The change applies straight away; there is no save button.
⚠️ Warning
Members who sign in with a password are asked to set up an authenticator app at their next sign-in. Tell them before you switch this on.
3. What members see when they set up 2FA
Members set up 2FA on their first sign-in after you require it, and on their first sign-in with a temporary link.
Install an authenticator app, such as Google Authenticator, Microsoft Authenticator or FreeOTP.
Sign in to revel8 with their password.
Scan the QR code on the Set up authenticator screen with the app. If scanning does not work, Enter key manually shows a key to type in instead.
Enter the 6-digit code from the app under One-time code.
Optionally, name the device under Device name, for example
My Phone.Choose whether to keep Sign out from other devices ticked, then click Verify & Activate.
After that, members enter a fresh code from the app every time they sign in.