Session and access policy, in the shortest form that is still accurate.
Accounts are issued to people, not to roles or teams. Shared accounts are not permitted — not because sharing is unlikely to work, but because nothing after the fact can tell you who did what.
Required, without exception and without a grace period. A passkey counts on its own; a password does not.
An account with no sign-in for 180 days is disabled. Re-enabling is an administrative action, not self-service. Disabling is reversible and does not delete anything.
Sign-ins, sign-outs and recovery events are recorded with time, network address and method, and kept for one year. Failed attempts are recorded on the same terms.
Account help