# A Company's Access Policy and Sessions

Set how long a company's people stay signed in, the addresses they may use, who gets in past single sign-on, and sign everyone out when you need to.

Each company you sell to has an access policy for its people, whichever way they sign in: how long a session lasts, the addresses it may come from, and the ways in besides single sign-on. You set it on the company's page in the console; the company's own admins can see and change it in your app too. Every setting is described in the [reference](/authentication/enterprise-sso#access-policy).

> **Note:**

- A company with Enterprise SSO set up ([Enterprise SSO](/sign-in-setup/enterprise-sso)).
- An owner or admin role in the console.

[Open the Enterprise tab in the console](https://console.buildbase.app/dashboard/admin/auth?tab=enterprise)

## 1. Choose how long a session lasts

On the **Enterprise** tab, open the company, then **Access policy**. **Sign out after inactivity** ends a session after that long without a request; **Sign out after, however active** ends it that long after sign-in, whatever the person does.

![Sign out after inactivity at 1 hour and Sign out after, however active at 12 hours, highlighted as step 1](/images/sign-in-setup/enterprise-access-policy/console-session-limits.webp)

## 2. Keep it to the company's addresses

Turn on **Only allow these addresses** and list up to 100 addresses or CIDR ranges, one per line. Outside them a sign-in is refused, and a session's requests get `403 ip_not_allowed` until they come from an allowed address again. If your app calls BuildBase from its own server with a person's session, add that server's addresses too.

![Only allow these addresses on, with 203.0.113.0/24 in Allowed addresses highlighted as step 2](/images/sign-in-setup/enterprise-access-policy/console-ip-allowlist.webp)

## 3. Name the break-glass people

**Break-glass people** are up to five of the company's people, by email, who may sign in another way while single sign-on is required, for when the identity provider is down. **Only with a passkey** limits them to a passkey. They must already be one of the company's people.

![Break-glass people with it-admin@northwind.example highlighted as step 3](/images/sign-in-setup/enterprise-access-policy/console-break-glass.webp)

## 4. Choose the ways in without single sign-on

**Sign-in methods without single sign-on** lists the ways the company's people may sign in when they do not use single sign-on, break-glass people included. Single sign-on is always allowed; none ticked means every way your app offers ([reference](/authentication/enterprise-sso#sign-in-methods-without-single-sign-on)).

![Sign-in methods without single sign-on: Password highlighted as step 4, Magic link, and the ways not turned on yet, each with Turn it on in Sign-in methods](/images/sign-in-setup/enterprise-access-policy/console-methods-without-sso.webp)

## 5. Save the policy

Press **Save policy**. A policy that limits or blocks people outside the company in its workspaces asks you to confirm first.

![Save policy highlighted as step 5, beside Sign everyone out](/images/sign-in-setup/enterprise-access-policy/console-save-policy.webp)

## Sign everyone out

**Sign everyone out** ends every session, and every connected app or agent, of the company's people now. They can sign in again at once; to keep someone out, deprovision them in their directory. One person's sessions are on their row under **People** ([reference](/authentication/enterprise-sso#one-session-one-person-or-everyone)).

![Sign everyone at Northwind out? with Sign everyone out highlighted](/images/sign-in-setup/enterprise-access-policy/console-sign-everyone-out.webp)

**Sessions** on a person's row lists each device they are signed in on, and **End** signs out that one:

![Dana Reyes's sessions: 1 live session, Chrome on Linux from an example address, signed in by single sign-on, with End, Refresh and Reset passkeys](/images/sign-in-setup/enterprise-access-policy/console-person-sessions.webp)

## Require single sign-on

Once the company's connection is active, its **Settings** offer **Require single sign-on**. With it on, its people are refused at every other way in, except its break-glass people. Turn it on only once the connection works ([reference](/authentication/enterprise-sso#2-add-an-enterprise)).

![Settings: Create accounts on first sign-in on, the Require single sign-on switch highlighted, still off, and Role for new accounts](/images/sign-in-setup/enterprise-access-policy/console-require-sso.webp)

## Check that it worked

With a narrow address list, a sign-in from another address is refused with `403 ip_not_allowed`, and a session left idle past the limit ends with `401 session_ended`. On the hosted page, the person reads why:

![The hosted sign-in page after a Northwind sign-in from outside its addresses: Your company only allows sign-in from its own network. Connect to it (or its VPN) and try again, or ask your IT team.](/images/sign-in-setup/enterprise-access-policy/hosted-ip-not-allowed.webp)

## Things to watch out for

- **Break-glass covers only people already linked** to the company.
- **The network rule needs the company's IT team.** Keeping the company's network to its own accounts is a header their proxy adds; send them [the page for IT admins](/authentication/enterprise-sso-it-admin#keep-your-network-to-your-company-s-accounts).
- **Your console is never held to the policy**, so you cannot lock yourself out of it.

## Next steps

- [Enterprise SSO](/authentication/enterprise-sso#access-policy) - every setting of the access policy
- [Enterprise SSO setup](/sign-in-setup/enterprise-sso) - connect the company first
- [Sign-in setup guides](/sign-in-setup/overview) - every other way to sign in