Skip to main content
Miscellaneous

Login security: passwords, 2FA, sessions, and IP restrictions

The Security tab defines password and session policies, mandatory 2FA, and allowed login IP addresses.

Last updated 13 days ago

Passwords, sessions, and mandatory 2FA

Go to Settings → Miscellaneous → Security. Here, you can choose how often the user must change their password and set the browser session duration.

A shorter session reduces risk if a device is left unlocked, but the user will have to log in more frequently. Choose a duration based on your organization's workplace setup and device usage policies.

If Mandatory 2FA is enabled, the user will require a second authentication factor. Before enabling this for the entire account, inform your team and be prepared to assist with registering or recovering the second factor.

Login restrictions by IP address

In the Settings → Miscellaneous → Security section, you can restrict logins to specific IP addresses.

  1. Enter the office or VPN public IP address into the table.
  2. Specify who the address belongs to in the comment field.
  3. Add at least one backup trusted address.
  4. Enable Use IP restriction and save.

Hanna automatically adds the administrator's current IP to the list if it is not already there. However, be prepared for instances where your internet service provider or VPN changes the address. First, test the restriction in a separate browser session; do not close the active administrator session until you have verified access.

If you cannot log in or reset your password

  1. Check that you opened your company's Hanna address and are using the email recorded in your staff account. Ask an administrator to check that the account is active.
  2. If the reset email is missing, check spam and your organization's email quarantine. A sending confirmation does not confirm delivery to the inbox.
  3. Use the link in the most recent reset email: a new request replaces the previous reset key. If the link has expired, submit one new request and wait for the email.
  4. If you are stopped at 2FA, start the login process again and enter the current code from your authenticator app. Resetting your password does not by itself resolve loss of access to the second factor; contact your administrator if you cannot access it.
  5. If access depends on the network, an administrator should compare your current public IP with the allowed addresses. Check whether your VPN or workplace internet connection has changed.

If the issue persists, send Hanna Customer Support your company's Hanna address, the attempt time and time zone, the exact error text, and the step where you are stopped: password, reset link, or 2FA. Do not send passwords, reset links, or one-time codes.

Was this helpful?

Still need help? Ask the team