---
title: "Authentication & sessions"
description: "Set shared sign-in limits and multi-factor authentication requirements."
source: "https://docs.aplt.ai/docs/organisation-authentication-and-sessions"
updated: "2026-10-19T23:23:54.945276+00:00"
product: Autopilot
content_type: documentation
---

# Authentication & sessions

Set shared sign-in limits and multi-factor authentication requirements.

Organisation administrators can set shared sign-in and multi-factor authentication requirements for an Autopilot organisation and its linked dealerships. Open **Organisation → Security → Authentication & sessions**.

## Set sign-in limits

Under **Sign-in and sessions**, choose:

- **Sign in again after inactivity:** require a fresh sign-in when someone has stopped using Autopilot for the selected period.
- **Maximum time signed in:** require a fresh sign-in after the selected period, even if someone is actively using Autopilot.

Choose the available duration that fits your organisation’s working practices. These controls serve different purposes: activity does not extend the maximum sign-in period.

## Require multi-factor authentication

Turn on **Require multi-factor authentication** to require an authenticator app or passkey before people access your organisation.

When MFA is required, **Require MFA again** lets you choose every sign-in or remember successful MFA on that browser for a selected period. A new browser or signing out requires MFA again.

Turning the organisation’s MFA requirement off does not remove anyone’s existing authenticator app or passkeys. Sensitive security changes still require recent identity verification.

## Save the policy

Select **Save changes**. Use **Cancel** to discard unsaved changes. Check for the confirmation that authentication and session settings were saved.

If asked to **Verify identity**, complete verification and check the settings again before leaving. If Autopilot cannot confirm a save, reload to check the current policy before retrying.

## Who the rules affect

The policy applies to everyone accessing your organisation and its linked dealerships. Dealerships cannot override it. Dealerships outside an organisation keep the default session settings.

Tell staff before changing the policy, especially if they need to set up an authenticator or passkey. Link them to [manage your authenticator app](/docs/manage-two-factor-authentication/) or [manage your passkeys](/docs/manage-your-passkeys/).

## End someone’s sessions now

Changing a policy and signing someone out are different actions. Use [Active sessions](/docs/organisation-active-sessions/) to end a member’s browser sessions on all devices. Use [Offboarding](/docs/organisation-offboarding/) if they should no longer have access.