GuidesPassword policy and sessions
On this page0

Guide

Password policy and sessions

Decide how strong Zonitix passwords must be, stop people reusing old ones, and choose how long someone stays signed in.

For: AdministratorPlan: All plans

Before you start

  • An account that can manage Security Settings: an “administrator”, or someone you have given the “security_analyst” role.
  • These rules cover passwords kept in Zonitix. People who sign in through Okta, Entra or Google follow that directory’s password rules.
  • Pick a quiet moment before changing a password policy. Read step 3 first.

Password Policies

  1. Step 1: Open the tab

    Go to Security & ComplianceSecurity Settings and choose “Password Policies”.

  2. Step 2: Password history

    Under “PASSWORD HISTORY”, “Remember last” sets how many earlier passwords a person may not reuse. It takes a whole number from 0 to 24; 0 turns it off. The default is 5. It applies to everyone and only affects their next password change.

  3. Step 3: The Standard Policy

    Every instance has one policy called “STANDARD POLICY”, marked “APPLIES TO EVERYONE”. It applies to all users and cannot be deleted. Out of the box it asks for at least 8 characters with an uppercase letter, a number and a symbol.

    Click its edit button to change “Minimum Length” and the “Require Uppercase”, “Require Numbers” and “Require Symbols” boxes, then “Confirm Policy”.

    When you save a change to the Standard Policy, every person with a Zonitix password, you included, is asked to choose a new password the next time they sign in. Changing a group policy does the same for members of that group. People who sign in through single sign-on are not affected.

    Zonitix warns you first. If the change will force people to choose a new password, “Confirm Policy” opens “This policy forces a password change”, which says who is affected. Click “Keep this policy” to go on, or “Back” to change it. A yellow box, “Not saved yet — saving these settings will force a password change”, then stays on the tab until you save.

  4. Step 4: Stricter rules for some groups

    Click “NEW POLICY”, give it a “Policy Name”, set the requirements, and choose the groups it covers under “TARGET GROUPS”. Click “Confirm Policy”.

    A person must meet the Standard Policy and every policy for a group they are in. A group policy can make passwords stricter, never weaker. The “HOW POLICIES COMBINE” panel on the right says the same thing.

  5. Step 5: Save

    Click “SAVE SETTINGS” at the bottom. Nothing takes effect until you do.

Administrators follow the same policies as everyone else, with one exception: the password set for the primary administrator when your instance was first set up had to be at least 12 characters with an uppercase letter, a number and a symbol. To hold your admins to that standard afterwards, put them in a group and give that group its own stricter policy.

Sessions

  1. Step 6: Open the tab

    In Security Settings, choose “Sessions”.

  2. Step 7: Choose the absolute timeout

    “Absolute Timeout” is how long a sign-in lasts. When it runs out the person must sign in again, however active they have been. The default is “8 Hours (Standard)”.

    Zonitix accepts anything from 5 minutes to 24 hours. From the list, that means “15 Minutes”, “30 Minutes”, “1 Hour”, “8 Hours (Standard)”, “12 Hours” or “1 Day (Maximum)”.

    If the list shows a value followed by “(saved value — no longer accepted)” and a yellow warning, an older setting outside that range is still stored. Nothing on the Security Settings page can be saved until you choose one of the listed values.

  3. Step 8: Save

    Click “SAVE SETTINGS”. The new length applies from each person’s next sign-in. Sessions that are already open keep the length they started with.

The “CONCURRENT SESSIONS” panel shows “Sessions per user” as “UNLIMITED”: one account can be signed in on several devices at once, and a per-user limit is not available yet. There is no button that signs everyone out. To cut off one account, see steps 9 to 11.

Sign someone out, or make them choose a new password

  1. Step 9: Cut off an account right away

    On the Sessions tab, under “Ending Sessions Early”, click “OPEN USERS” (or go to AdministrationUsers). Click the edit button on the person’s row and set “Account Status” to “DISABLED”, then save. Their open sessions stop working from the next thing they click, and they cannot sign in again until you set them back to “ACTIVE”. For several people at once, tick them, click “BULK ACTION”, choose “Set status” and pick “Disabled” or “Inactive”.

  2. Step 10: Expire one person’s password

    Use this when a password may have leaked but the person should keep working. On AdministrationUsers, click the key button on the person’s row. Its tooltip reads “Expire password: sign out everywhere and require a new password at next sign-in”. Confirm with “Expire password”.

    The person is signed out on every device at once and must set a new password the next time they sign in.

  3. Step 11: Expire several passwords at once

    Tick the people in the list, click “BULK ACTION”, choose “Expire password” under “Action”, then click “APPLY TO N” and confirm. You can do up to 500 people in one go.

    Accounts that sign in through a directory, the primary administrator account and your own account are skipped. The result message says how many were changed and how many were skipped.

Expiring a password needs a role that lets you manage users. It only works for passwords kept in Zonitix. The key button is greyed out for someone who signs in through Okta, Entra or Google (reset the password in that directory instead), for the primary administrator account and for the Zonitix support account. You cannot expire your own password. Zonitix has no screen where a signed-in person changes their own password, and “My Profile” has no password field: ask another administrator to expire yours, then choose a new one in the “Password Change Required” window at your next sign-in.

What you should see

A green message: “Security settings updated successfully!”

The Password Policies tab lists each policy with its minimum length, the requirements it switches on (A-Z, 0-9, #@$) and the groups it applies to.

People choosing a new password see an error naming the policy they have not met.

If something goes wrong

"Failed to update security settings."
The usual causes are a Remember last value outside 0 to 24, or an old session timeout that is no longer accepted (the Sessions tab shows it as "saved value — no longer accepted"; choose a value from the list). Nothing on the page was saved, so fix the value and save again, then re-check any other changes you made at the same time.
Someone says their password has a symbol but is still refused
Any character that is not a letter, a number or a space counts as a symbol, including - _ + = and whatever a password manager generates. If a password is still refused, read the message: it names the policy and the rule that was not met.
Someone keeps getting "Invalid username or password" with the right password
After 5 wrong passwords in a row an account is locked for 15 minutes. The sign-in page shows the same text every time a sign-in is refused: "Invalid username or password." followed by "After 5 wrong attempts an account is locked for 15 minutes — if that may be you, wait before trying again. Accounts managed by your company directory sign in with single sign-on, not a password." It is the same for a wrong password and for a locked account, on purpose, so it never confirms that this particular account is locked. The 5-attempt, 15-minute rule is fixed and not set on this page. Ask the person to wait 15 minutes, then try again.
Everyone was asked for a new password after you edited a policy
That is expected: saving a change to the Standard Policy expires every Zonitix password. Warn people before you change it.
"You cannot expire your own password here. Change it from your profile instead."
Expire password is for other people’s accounts, and the message is out of date: My Profile has no password field. To change your own password, ask another administrator to click the key button on your row. You are signed out, and at your next sign-in a window titled Password Change Required asks for a New Password and Confirm New Password. The primary administrator’s account cannot be expired from the Users page. A saved change to the Standard Policy (step 3) does ask it for a new password, because that asks everyone with a Zonitix password.
The key button on a row is greyed out
Hover over it to see why. The account signs in through a directory (reset the password there), it is the primary administrator account, or your role does not let you manage users.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

Previous
Turn on single sign-on
Next
Block countries and IP addresses