---
title: Organization security
description: "Set team password rules, require MFA for everyone, control session timeouts, and manage API keys."
canonical_url: https://housingstreet.com/help/settings/security
md_url: https://housingstreet.com/help/settings/security.md
last_updated: 2026-07-20
status: ga
relatedRoutes: ["/settings/security"]
---

## What this is [#what-this-is]

**Security** settings are for your *organization* — rules that apply to the whole team, plus API keys for integrations.

Your *personal* password, email, authenticator app, and the list of devices where you are signed in live under **Settings → My Account**. See [My Account](/help/settings/account).

**Two-factor authentication (MFA)** here means requiring the team to use it — not enrolling your own authenticator. Enroll your own app on My Account.

<UiPath path="Settings → Security" />

<DocScreenshot src="/help-media/enterprise/security.png" alt="Organization security settings with password policy, MFA enforcement, session management, and API keys" caption="Set rules for the whole team" />

## Steps [#steps]

<Steps>
  <Step title="Open organization security">
    Go to **Settings → Security**.
  </Step>

  <Step title="Set password rules for the team">
    Expand **Password Policy**. Choose minimum length, expiry, reuse limits, lockout after failed attempts, and character requirements. Click **Save Changes**.
  </Step>

  <Step title="Require MFA for the team">
    Expand **Two-Factor Authentication**. Enable the main toggle, then turn on **Enforce MFA for all users** if everyone must set up an authenticator. Choose **Allowed Methods** and &#x2A;*Grace Period (days)** as needed. Click **Save Changes**.
  </Step>

  <Step title="Set session timeouts">
    Expand **Session Management**. Set max concurrent sessions, session timeout, and absolute timeout. Optionally require re-authentication for sensitive actions or terminate sessions when a password changes. Click **Save Changes**.
  </Step>

  <Step title="Manage API keys (when available on your plan)">
    Scroll to **API Keys**. Create, copy, or revoke keys your apps use to call HousingStreet. Treat keys like passwords.
  </Step>

  <Step title="Handle your own login (My Account)">
    To change *your* password, email, authenticator, or revoke *your* device sessions, open **Settings → My Account** instead.
  </Step>
</Steps>

## Expected result [#expected-result]

Team members must follow your password and MFA rules. Sessions expire on the timeouts you set. API keys work for allowed integrations. Your personal login settings stay on My Account.

## Related [#related]

* Personal profile, password, email, MFA enrollment, and active devices → [My Account](/help/settings/account)

<RelatedAdminLink href="/settings/security" label="Open security settings" />