# General settings: users and security

What each option of the Users, Password Policy and Permissions boxes of the general settings does, from inviting users and password rules to two-factor authentication and external sign-in.

These options decide who can sign in, how strong passwords must be, and what users may do on their own.

## Before you start {#before-you-start}

- Changing settings needs the **Administrator** role (**Role** on the user's **Access Rights** tab).

## Users {#users}

Open **Settings/General Settings**. The **Users** box comes first.

![The Users box, to invite people and manage users.](https://jaah.app/web/image/8822-c130bf56/general-settings-users-security-general_settings_users-en.png)

- **Invite New Users:** type an e-mail address and click **Invite**: the person receives an invitation to choose a password. The **Pending Invitations** are listed below until they are accepted.
- **Manage Users:** opens the list of users, with their roles and access rights. See [Create a user and set access rights](create-a-user-and-set-access-rights).

## Password Policy {#password-policy}

The rules every new password must follow, checked when a user chooses or changes a password:

- **Minimum Length:** the fewest characters a password may have, 8 by default.
- **Require Numbers:** at least one digit. On by default.
- **Require Uppercase:** at least one capital letter. Off by default.
- **Require Lowercase:** at least one small letter. Off by default.
- **Require Symbols:** at least one symbol such as ! or @. Off by default.

![The Password Policy box and its rules.](https://jaah.app/web/image/8826-3e354071/general-settings-users-security-general_settings_password-en.png)

## Permissions {#permissions}

- **Password Reset:** on by default; the sign-in page offers a "reset password" link that e-mails the user. Turn it off to have only administrators reset passwords.
- **Default Access Rights:** the access rights a new user receives, before anyone changes them. Set them once to the rights most of your staff need.
- **API Keys:** lets users create keys so external tools can connect to their account even when two-factor authentication is on.
- **Enforce two-factor authentication:** asks users for a code sent by e-mail at sign-in, for **Employees only** or for **All users**, portal users included, unless they set up an authenticator app.
- **Import & Export:** lets users bring data in from spreadsheet files (CSV, XLS, XLSX, ODS). See the Essentials page on export and import.
- **Show Effect:** shows a short animation when a user finishes something notable. Turn it off for a quieter screen.

![The Permissions box.](https://jaah.app/web/image/8830-238ce0ab/general-settings-users-security-general_settings_permissions-en.png)

## Signing in with another account {#external-sign-in}

In the **Integrations** box, two options let users sign in with an account they already have:

- **OAuth Authentication:** sign in with an external account such as Google.
- **LDAP Authentication:** sign in with the user name and password of the company directory.

Click **Save** to apply your changes.

## FAQ {#faq}

### Does a stricter password policy affect current passwords? {#current-passwords}

No. The rules apply when a password is chosen or changed; existing passwords keep working until their owner changes them.

---

- Source: https://jaah.app/docs/general-settings/users-and-security-settings
- Updated: 2026-10-16
- Version: General settings and administration 19.0.1.0
- Verified: 2026-10-16