User Policies

Overview

User policies define organization-wide rules for onboarding and account security. Configure them early—especially in production—to reduce risk and avoid privilege creep.

User registration settings

Control how new users can join the platform:

• enable email verification
• require admin approval (recommended for enterprise production)
• restrict registration domains (if supported)

Default role settings

Default roles matter because they define what a new user can do on day one. Use the least-privilege role that still enables onboarding.

Related: Role permissions.

Password policy

Use strong password rules to protect accounts:

• minimum length and complexity
• rotation and expiry rules (commonly 60–90 days)
• lockout policies and MFA (where supported)

Best practices

• Require admin approval in production.
• Default new users to Reader or a limited contributor role.
• Review access regularly and remove inactive accounts.

Related articles

• User management
• Audit logs