Skip to content
Sign in Get started
Documentation

9bx user guide

Administration

Security and single sign-on

Set the workspace two-factor rule, see who has enrolled and reset a lost phone, limit sign-in to your office networks (IP allowlist), and let people sign in with your company's identity provider (single sign-on).

Contents: Who can use it · Security page · Two-factor policy · Reset two-factor · IP allowlist · Single sign-on · Add a provider · Verify a domain · Test and switch on · Require SSO · How sign-in works · Example · Tips · FAQ

Who can use it

People whose role has the security permission (Security) or the single sign-on permission (Single sign-on). Both are normally Owner and administrator rights.

Where: Settings → Security and Settings → Single sign-on.

The Security page

"Two-factor authentication for the people in this workspace."

Part Meaning
Counters Members, Enrolled, Required, Still to enrol How many people have two-factor on
Two-factor authentication policy Who must use an authenticator app on top of their password
Members table Member, Role, Two-factor (On since a date, or Off), Last sign-in, and Reset. Filters All / Not enrolled and Search name or email

The other security items you may see elsewhere, such as password rules, IP allowlist and session timeout, are not set from this page.

Set the two-factor policy

  1. Open Security.
  2. Choose one policy:
Policy Result
Optional Anyone can turn it on for their own account
Admins and owners Owners and administrators must set it up before they can use 9bx
Everyone Every member must set it up before they can use 9bx
  1. Save. You see "Two-factor policy saved."

People it applies to who have not set it up are sent to the setup screen at their next request, and the mobile app asks them to do it on the web. People whose organization requires single sign-on use their identity provider's multi-factor instead.

Reset a member's two-factor

For someone who lost their phone and recovery codes:

  1. Find the member in the Members table.
  2. Click Reset ("Reset this member's two-factor (lost phone)").
  3. Confirm Reset two-factor for {name}? Their authenticator app and recovery codes stop working. They sign in with their password and set it up again if the policy requires. The reset is recorded in the activity log.

IP allowlist

Let members sign in and work only from your own networks. The IP allowlist card on the Security page has:

Item Meaning
Restrict sign-in to listed addresses Turns the allowlist on. Sign-in, and every action in the web app, the mobile apps and with API tokens, is refused from any other address.
Owner can sign in from anywhere A break-glass exception for the workspace owner. Off by default, so the owner is restricted too. Only the owner can change it.
Your current address The address your browser is using now, and whether the list covers it (In the list / Not in the list). Add my address adds it.
Allowed addresses and ranges Single addresses (203.0.113.7, 2001:db8::7) or ranges in CIDR form (203.0.113.0/24, 2001:db8::/48), each with a label such as "Head office". Up to 200.

To turn it on:

  1. Add the public address or range of every office, and of every remote team that must keep working. Click Add my address if your own is not listed.
  2. Switch on Restrict sign-in to listed addresses and click Save.
  3. Confirm Turn on the IP allowlist?. You see "IP allowlist saved."

You cannot lock yourself out: saving is refused with "Your current address (…) is not in the list. Add it first…" while the list does not cover the address you are using (unless you are the owner and the owner exception is on). The list cannot be empty while the allowlist is on.

What members see: on a network that is not in the list, sign-in shows "Your organization only allows access from approved networks, and your current address (…) is not one of them. Contact your administrator." Someone already signed in is signed out with the same message at their next action. Public pages (careers, payment links, web forms) and incoming webhooks are not affected.

Every change (turned on or off, addresses added or removed, the owner exception) and every refused attempt is recorded in the activity log. If your office address changed and nobody can sign in, contact 9bx support: they can turn the allowlist off for you (your list is kept).

Single sign-on

SSO lets your people sign in with the identity provider your company already uses: Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak, or any OIDC or SAML provider. Empty page: "Add your identity provider, verify your email domain, test it, then switch it on."

Add an identity provider

  1. Click Add identity provider.
  2. Choose the type: OIDC (Google, Microsoft, Okta, Auth0, Keycloak and others) or SAML (ADFS, OneLogin, JumpCloud, PingFederate and others).
  3. Enter a Name shown on the sign-in page ("Padma Okta").
  4. For OIDC: Issuer URL (9bx reads its standard discovery address; use Discovery URL only if it differs), Client ID, Client secret (stored encrypted; the eye shows it again after asking for your password) and Scopes (must include openid). For SAML: IdP entity ID, SSO URL, and the Signing certificate (PEM).
  5. Under Attribute mapping map Email (NameID or emailaddress), First name and Last name if your provider uses different names.
  6. Under Access & provisioning choose whether to Create accounts on first sign-in and the Role for new accounts (Owner and administrator roles can never be given automatically), whether to Require single sign-on, and the Break-glass account.
  7. Choose to offer the provider on the sign-in page and click Add provider.

On the provider card, Enter these at your identity provider shows what to copy into your provider: Redirect URI (OIDC) or Entity ID, ACS URL and Metadata URL (SAML). Use Copy.

Verify your email domain

A provider works only for domains you prove you own, and a domain can belong to only one provider on the whole platform.

  1. In Email domains click Add domain and enter, for example, padmanet.example.
  2. 9bx shows "Add this TXT record at your DNS provider, then verify": a record named _9bx-verification.padmanet.example and a Value.
  3. Create it at your DNS company, wait a few minutes, then click Verify. The domain shows Verified; otherwise Not verified.

Remove a domain with Remove domain.

Test and switch on

  1. Click Test connection. The result shows Configuration looks good or Configuration has problems with the checks that passed or failed, and "Last tested {date}".
  2. When it passes, click Switch on. Use Switch off to pause it, or remove the provider (people can then no longer sign in through it).

Require single sign-on

When Require single sign-on is on, people on your verified domains cannot use their password. To avoid locking everyone out you must choose a Break-glass account: an active owner or administrator who can still sign in with a password if the provider is down. The card shows it as Break-glass account. The provider list also shows a Required tag.

How people sign in

  1. The person enters their work email on the sign-in page.
  2. 9bx finds the provider by the email's domain and offers Continue with SSO.
  3. They sign in at the provider and return to 9bx.

If Create accounts on first sign-in is on, a user and employee record are created at first sign-in with the role you chose. The provider also shows recent sign-in events. People outside your verified domains cannot use the provider.

Example scenario

Padma Net Support uses Google Workspace. Rafiq adds an OIDC provider, copies the Redirect URI into Google, adds the domain padmanet.example, creates the TXT record, clicks Verify, then Test connection (passed) and Switch on. Later he turns on Require single sign-on with himself as break-glass account. New staff get the Agent role automatically on first sign-in.

Tips

  • Keep the TXT record after verification; it is checked regularly.
  • Test before switching on, and before requiring SSO.
  • Always keep a working break-glass owner.
  • Before turning on the IP allowlist, list every office and remote team, including mobile users who work from the field.

Troubleshooting and FAQ

"Single sign-on is not set up for this email domain." The domain is not verified or the provider is off.

Verify does not work. DNS changes can take up to a day; check the record name and value exactly.

I locked myself out. Sign in with the break-glass account.

A member cannot sign in after the policy changed. They must finish two-factor setup at their next request.

"Your organization only allows access from approved networks…" The member's network is not in the IP allowlist. Add its address, or ask them to connect from the office.

Your profile and account security · Team members and roles · Custom domain

See also Directory sync to keep people in step with your company directory.