For AI agents: a documentation index is available at /llms.txt. A markdown version of this page is available at /guide/cloud/admin/security.md.
Security
Two-factor authentication, single sign-on, and the settings worth getting right.
Two-factor on all tiers, SSO on Premium
Two-factor authentication is available on every plan. Single sign-on requires Premium Unlimited.
#Two-factor authentication
The highest-value security change available on any tier, and the cheapest.
Enable it for admins first
An admin account can see every project and change billing. If you do nothing else on this page, do this.
Then require it workspace-wide
Announce it, give people a week, then enforce.
Make sure people save recovery codes
The support burden of 2FA is almost entirely people who lost their phone and have no recovery code.
Have a recovery path before you enforce
Know how an admin who loses their second factor gets back in — before it happens, not during.
#Single sign-on Premium
Authenticate through your existing identity provider. Worth it when you have enough people that account lifecycle is a real burden.
One set of credentials, central policy enforcement, and offboarding that actually removes access everywhere.
Setup with your IdP, a break-glass admin account, and a decision about whether password login stays enabled.
Keep one non-SSO admin
If SSO breaks or the IdP is misconfigured, an account that can sign in without it is the difference between a short incident and being locked out of your own workspace. Protect it with 2FA and a strong password.
#Offboarding with SSO
Removing someone at the IdP blocks sign-in, but their Orangescrum account is still there and still assigned work. Do both:
Reassign their tasks
Before anything else.
Remove them at the identity provider
Blocks authentication.
Deactivate in Orangescrum
Removes them from views and assignment lists.
#Sessions and access
The admin list grows and never shrinks on its own.
Integrations authorised with a departed person's account fail silently. Use service accounts.
Access accumulates. People rarely get removed from projects they have stopped working on.
#API keys Premium
Developer API keys are credentials with real reach.
Scope them narrowly
Read-only where the integration only reads. A wildcard scope should be rare and deliberate.
One key per integration
So you can revoke one without breaking the others, and the audit trail tells you which system did what.
Store them properly
A secrets manager. Never source control, never a shared document. The secret is shown once and cannot be retrieved.
Rotate and revoke
Rotate periodically; revoke immediately when an integration is retired.
MCP keys can write
A key connected to an AI assistant lets it create and change real records. Start read-only, watch the audit trail, and widen scope only once you trust the workflows.
#Data handling
Attachments inherit project permissions
A file on a task is visible to that project's members. Sensitive material belongs in a project with restricted membership, not a general one.
Linked Drive files have their own permissions
A Drive link is governed by Google's sharing, not Orangescrum's. The two can disagree.
Export before downgrading or cancelling
Access to a tier's data ends with the tier. Export while you still have it.