Workbooks provides several ways for users to authenticate when they sign in. Security Policies define which methods are allowed in your account, and configure specific aspects of each method where appropriate.

Password login

The default authentication mechanism in Workbooks is via a password. The Password security policy defines how complex passwords must be in your account, when they expire, whether they can be reused, and whether a user can regain access to their account if they have forgotten their password.

Google login

Authentication via Google reduces the need for users to enter their password. When they first login via Google they will be prompted for their Workbooks login name (email address) and password, to associate their Google identity with their Workbooks user. From then on they can sign in to Workbooks with just one click on the 'Login using your Google account' button.

Note: if Password login is disabled, users can still login via Google but they will need to know their password to be able to associate their Google identity with their account the first time.

Microsoft login

If your organisation subscribes to Microsoft's Azure Active Directory service, then you can configure Workbooks to allow logins via Microsoft Login. You may already have an Azure Active Directory tenancy via another Microsoft service such as Office 365.

If your organisation does not use any Microsoft Azure services, but does have on-premises Microsoft Active Directory then you can also subscribe to Microsoft Azure Active Directory and configure Azure Active Directory Connect to synchronise identities between Active Directory and Azure.

Granting Workbooks permission to act on behalf of your users in Azure will enable them to login without ever being prompted for a password. In fact, this is the most secure authentication mechanism, and we would recommend that you disable Password and Google authentication in Workbooks so that there is no reliance on passwords.

The benefits of Workbooks integration with Microsoft Azure Active Directory include:

• being able to disable users centrally, thus removing their access from Workbooks and any other services.
• being able to create users in Azure Active Directory, and for those users to be able sign into Workbooks immediately. Their Workbooks user account can be provisioned automatically from User Templates as they sign in. See 'Configuring Microsoft Azure Active Directory integration' for details.

Login Protection

When a device is first used to sign into Workbooks from an IP address that the user has not used recently, Workbooks can email a link to the user. The user must click on the link to confirm that they are using the device, to permit the login to proceed.

Login Protection can be used with any of the other authentication mechanisms, and it adds another authentication factor by confirming that the user has access to their email account as well as being able to authenticate. We recommend that it is enabled.

Per-user controls

The Security Policies define the account-level controls for how users authenticate themselves to Workbooks. For finer-grained control, you can also enable and disable these policies on each User record.