Authentication & sessions
Set shared sign-in limits and multi-factor authentication requirements.
Organisation administrators can set shared sign-in and multi-factor authentication requirements for an Autopilot organisation and its linked dealerships. Open Organisation → Security → Authentication & sessions.
Set sign-in limits
Under Sign-in and sessions, choose:
- Sign in again after inactivity: require a fresh sign-in when someone has stopped using Autopilot for the selected period.
- Maximum time signed in: require a fresh sign-in after the selected period, even if someone is actively using Autopilot.
Choose the available duration that fits your organisation’s working practices. These controls serve different purposes: activity does not extend the maximum sign-in period.
Require multi-factor authentication
Turn on Require multi-factor authentication to require an authenticator app or passkey before people access your organisation.
When MFA is required, Require MFA again lets you choose every sign-in or remember successful MFA on that browser for a selected period. A new browser or signing out requires MFA again.
Turning the organisation’s MFA requirement off does not remove anyone’s existing authenticator app or passkeys. Sensitive security changes still require recent identity verification.
Save the policy
Select Save changes. Use Cancel to discard unsaved changes. Check for the confirmation that authentication and session settings were saved.
If asked to Verify identity, complete verification and check the settings again before leaving. If Autopilot cannot confirm a save, reload to check the current policy before retrying.
Who the rules affect
The policy applies to everyone accessing your organisation and its linked dealerships. Dealerships cannot override it. Dealerships outside an organisation keep the default session settings.
Tell staff before changing the policy, especially if they need to set up an authenticator or passkey. Link them to manage your authenticator app or manage your passkeys.
End someone’s sessions now
Changing a policy and signing someone out are different actions. Use Active sessions to end a member’s browser sessions on all devices. Use Offboarding if they should no longer have access.