# Security

> Two-factor authentication, single sign-on, and the settings worth getting right.

> For the complete documentation index, see [llms.txt](https://helpdesk.orangescrum.com/llms.txt).

Source: https://helpdesk.orangescrum.com/guide/cloud/admin/security

---
> **Two-factor on all tiers, SSO on Premium**
>
> Two-factor authentication is available on every plan. Single sign-on requires
> Premium Unlimited.

## Two-factor authentication

The highest-value security change available on any tier, and the cheapest.

**Enable it for admins first**

    An admin account can see every project and change billing. If you do nothing
    else on this page, do this.

**Then require it workspace-wide**

    Announce it, give people a week, then enforce.

**Make sure people save recovery codes**

    The support burden of 2FA is almost entirely people who lost their phone and
    have no recovery code.

> **Have a recovery path before you enforce**
>
> Know how an admin who loses their second factor gets back in — before it
> happens, not during.

## Single sign-on 

Authenticate through your existing identity provider. Worth it when you have
enough people that account lifecycle is a real burden.

- **What you gain**: One set of credentials, central policy enforcement, and offboarding that actually removes access everywhere.

- **What to plan for**: Setup with your IdP, a break-glass admin account, and a decision about whether password login stays enabled.

> **Keep one non-SSO admin**
>
> If SSO breaks or the IdP is misconfigured, an account that can sign in without
> it is the difference between a short incident and being locked out of your own
> workspace. Protect it with 2FA and a strong password.

### Offboarding with SSO

Removing someone at the IdP blocks sign-in, but their Orangescrum account is
still there and still assigned work. Do both:

**Reassign their tasks**

    Before anything else.

**Remove them at the identity provider**

    Blocks authentication.

**Deactivate in Orangescrum**

    Removes them from views and assignment lists.

## Sessions and access

- **Review admins quarterly**: The admin list grows and never shrinks on its own.

- **Audit integration credentials**: Integrations authorised with a departed person's account fail silently. Use service accounts.

- **Check project membership**: Access accumulates. People rarely get removed from projects they have stopped working on.

- **Watch the audit trail**: On Premium — see [Audit trail](https://helpdesk.orangescrum.com/guide/cloud/admin/audit-trail).

## API keys 

[Developer API](https://helpdesk.orangescrum.com/guide/api/authentication) keys are credentials with real reach.

**Scope them narrowly**

    Read-only where the integration only reads. A wildcard scope should be rare
    and deliberate.

**One key per integration**

    So you can revoke one without breaking the others, and the audit trail tells
    you which system did what.

**Store them properly**

    A secrets manager. Never source control, never a shared document. The secret
    is shown once and cannot be retrieved.

**Rotate and revoke**

    Rotate periodically; revoke immediately when an integration is retired.

> **MCP keys can write**
>
> A key connected to an [AI assistant](https://helpdesk.orangescrum.com/guide/mcp/introduction) lets it create
> and change real records. Start read-only, watch the audit trail, and widen
> scope only once you trust the workflows.

## Data handling

**Attachments inherit project permissions**

    A file on a task is visible to that project's members. Sensitive material
    belongs in a project with restricted membership, not a general one.

**Linked Drive files have their own permissions**

    A [Drive link](https://helpdesk.orangescrum.com/guide/cloud/integrations/google-workspace) is governed by
    Google's sharing, not Orangescrum's. The two can disagree.

**Export before downgrading or cancelling**

    Access to a tier's data ends with the tier. Export while you still have it.

- [Audit trail](https://helpdesk.orangescrum.com/guide/cloud/admin/audit-trail): Who did what, and when.

- [Security overview](https://www.orangescrum.com/securities): Orangescrum's platform security posture.