---
title: Password, session length and IP addresses
description: "Set the password rules, the number of sign-in attempts and the session length, and restrict access to Illizeo with allowed or blocked IP addresses."
url: "https://illizeo.com/en/centre-aide/security-password-session-and-ip-addresses/"
updated: "2026-11-05"
category: "Platform / Security & compliance"
---

# Password, session length and IP addresses

This article explains how to set your workspace's password rules, limit sign-in attempts, set the session length and restrict access to Illizeo by IP address. It is for administrators. The rules set here apply to every user of the workspace: employees, managers and administrators.

## Before you start

- Permissions are set in **Settings › Manage Employees › Employee Roles**, in the "Platform administration" menu of the role matrix (see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/)).
- Password rules and attempts: the "Password configuration" permission (Authentication section). The **Access** level lets you read the page, the **Execute** level lets you change it.
- Session length: the "Platform settings" permission (Global settings section), at the **Execute** level to change it.
- Allowed and blocked IP addresses: the "Whitelisted IPs" permission (Security & access section), at the **Execute** level, including to view the two lists.
- By default, only the Administrator role holds these permissions.

## Password rules

1. Open **Settings › Manage Illizeo › Authentication**. The **Password Configurations** page opens in read mode.
2. Click the edit icon at the top right of the card. It only appears with the Execute level.
3. Set the rules (see below), then click **Save**, or **Cancel** to go back to the saved values.

The available rules:

- **Minimum length** and **Maximum length**: the minimum cannot exceed the maximum. With no minimum (value 0), Illizeo requires at least 8 characters.
- **Mixed case required**: at least one lower-case and one upper-case letter.
- **Alpha characters required**: at least one letter.
- **Non-alpha characters required**: at least one character other than a letter: a digit or a symbol.
- **Numeric characters required**: at least one digit.
- **Special characters required**: at least one symbol.
- Under "Password cannot contain any of the following user information :", the **First Name**, **Last Name** and **Username** switches reject a password containing that information, whatever the case.

![The Password Configurations page: password rotation and forgotten password switches, minimum and maximum length, character requirements and forbidden information (first name, last name, username)](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-password-session-and-ip-addresses-01.en_.png?resize=800%2C500&quality=80&ssl=1)
Settings › Manage Illizeo › Authentication: password rules.

These rules apply whenever a password is chosen: when accepting an invitation, changing one's own password, resetting it by email, and when an administrator sets an employee's password. Illizeo also rejects a password found in a known data breach. The rules are not checked again at sign-in: an existing password keeps working until it is next changed.

## Sign-in attempts

Under **Login Authentication :**, on the same page:

- **Maximum number of login attempts**: from 1 to 20, 5 by default.
- **Waiting time between 2 failed connections**: from 1 to 10 minutes, shown in hours and minutes, 5 minutes by default.

The counter covers one email address from one IP address. After each failure, the sign-in screen shows how many attempts are left. Once the maximum is reached, sign-in for that account from that IP address is blocked for the set time, and the screen shows a countdown. A successful sign-in resets the counter. An unknown email address is counted in the same way: the screen never reveals whether an account exists.

## Forgotten password

- **Enable Forget Password feature** on: the **Forgot?** link on the sign-in screen sends a reset link, valid for 30 minutes.
- Switch off: the link is still shown, but no email is sent. The screen gives the same answer in every case, so that nothing is revealed about existing accounts.
- Whatever this switch, the **Get a sign-in link by email** button sends a link that signs the person in without a password, single-use and valid for 15 minutes. It disappears when single sign-on is required.
- An administrator can also help an employee from their profile: ⋮ menu, **Manage account**, **Reset Employee Password** block, with **Send Reset Email** ("Send a password reset email" permission) or **Define Password** ("Set an employee's password directly (bypassing the email flow)" permission), at the Execute level.

## Session length

1. Open **Settings › Manage Illizeo › Global Settings › Manage Platform Settings**.
2. In the **Communication & Redirections** card, enter the **Session duration** in minutes: from 5 to 480, or 0 to turn off automatic logout. The default is 60 minutes.
3. Save the page.

![The Communication & Redirections card of the platform settings, with the Session duration field in minutes and its help text Inactivity duration before automatic logout](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-password-session-and-ip-addresses-02.en_.png?resize=800%2C213&quality=80&ssl=1)
Global Settings › Manage Platform Settings: the session length.

The session length is an inactivity period: as long as the person is working, their session is extended. Ten minutes before the end (or halfway through a short session), the "Are you still there?" window offers **Continue my session** or **Log out**. Without an answer, the session closes and unsaved work is lost. The rule applies to every way of signing in: password, email link and single sign-on.

## Allowed IP addresses

As long as no active address is in the list, access is not restricted. As soon as one address is active, Illizeo only accepts connections from the addresses and ranges in the list: at sign-in, then on every action, for every user, in the browser as in the mobile app.

1. Open **Settings › Manage Illizeo › Whitelisted IPs**. The **Whitelisted IP Addresses** page shows your current address.
2. If the "Your IP address is not whitelisted" banner appears, first click **Whitelist my IP**. As long as your own address is not in the list, Illizeo refuses to add any other: otherwise you would lock yourself out.
3. In **Add an IP address**, enter an IPv4 or IPv6 address, or a CIDR range (for example 192.168.1.0/24), and an optional label. Click **+ Add**.
4. On each line, the switch enables or disables the address, and the bin deletes it after you confirm with **Delete**.

![The Whitelisted IP Addresses page: the administrator's current address, Registered IPs, Active and Inactive counters, the Add an IP address form and the list of addresses, empty here](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-password-session-and-ip-addresses-03.en_.png?resize=800%2C500&quality=80&ssl=1)
Settings › Manage Illizeo › Whitelisted IPs.

The line covering your address carries the **YOUR IP** badge: you can neither disable nor delete it. The **Registered IPs**, **Active** and **Inactive** counters, and the search by address or label, complete the page.

## Blocked IP addresses

The block list does the opposite: an active blocked address is refused on every action, even if it is also in the allowed addresses. An empty list blocks nothing.

1. Open **Settings › Manage Illizeo › Blocked IPs**.
2. In **Block an IP address**, enter an address or a CIDR range and an optional label, then click **Block**.
3. The switch on a line suspends or restores the block. The bin (**Unblock**) removes the entry after you confirm with **Delete**.

![The Blocked IP Addresses page: reminder that the administrator's address cannot be blocked, Blocked IPs, Active and Inactive counters, the Block an IP address form and the list of blocks](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-password-session-and-ip-addresses-04.en_.png?resize=800%2C500&quality=80&ssl=1)
Settings › Manage Illizeo › Blocked IPs.

Illizeo refuses to block, or to re-enable, an entry covering your own address, CIDR ranges included. Suspending or removing a block is always possible.

## Good to know

- The address that counts is the one Illizeo receives: behind a company VPN or proxy, it is the public exit address. A person working from home or on a mobile network changes address: plan the matching ranges before turning on the allow list.
- The address lists apply to sessions already open, from the next action.
- A password is always case-sensitive.
- Successful and failed sign-ins are logged: see [Governance & security](https://illizeo.com/en/docs-category/platform-en/platform-governance-security/).

## FAQ

### An employee has no attempts left.

They must wait until the countdown ends, or sign in from another network. They can also ask for a sign-in link by email.

### After a network change, nobody can get in.

An administrator still signed in from an allowed address can add the new address. Otherwise, contact Illizeo support.

### Should the mobile app's addresses be listed?

Yes: the allow list also applies to the mobile app. A phone on a mobile network has an address that changes often; it will only be able to sign in from an allowed network, such as the company Wi-Fi.

### *Similaire*