Auth
Sign-in policy
MFA and e-mail verification, enforced at the mediation layer.
Multi-factor authentication
| Setting | Behaviour |
|---|---|
off | Password only. Suitable for internal test environments. |
optional | Users may enrol an authenticator; once they do, it is required for them. |
required | Every user must enrol before their first session is issued. |
E-mail verification
When on, a code is sent from the application’s sender domain and must be confirmed before a session is issued. Set a sender domain first or the code cannot be sent.
Where it is enforced
Policy is applied by DevSewa on every call it mediates to the identity engine — not only in the hosted UI. A client that skips your screens still meets the policy.