This article explains how sign-in to Varmo is secured and which rules you can set: password, second factor and passkeys, session duration and single sign-on via your company's sign-in service. The rules are set by a Tenant Admin; each person manages their own password.

Before you start

  • You find the rules for all people under Administration › Sign-in & security. Only Tenant Admins see this page.
  • The rules apply to all organisations in your account. You set the second factor per organisation.
  • Single sign-on is available from the Pro plan. Session rules and the second factor are available in all plans.
  • Password

    in addition, if the second factor is mandatory

    Code from an authenticator app
  • Passkey

    replaces password and code

    Fingerprint, face recognition or security key
  • Single sign-on (from Pro)

    for people of your domains

    Your company's sign-in service
  • Emergency access

    Tenant Admins only

    Password and second factor for emergency access
Ways to sign in to Varmo

On the left the way to sign in, on the right what it requires. With a password, a code from an authenticator app is also needed if the second factor is mandatory for the organisation. A passkey replaces password and code. With single sign-on from the Pro plan, people of your domains sign in via your company's sign-in service. Emergency access for Tenant Admins requires a password and a separate second factor.

Your own password and second factor

Each person changes their password themselves in the user menu at the top right under Change password. The new password has at least 12 characters; afterwards you are signed out on all other devices. If you have forgotten your password, choose Forgot password? on the sign-in page.

If your account is managed by the sign-in account management, Change password instead opens the Sign-in and password page with the Open account management button. There you change your password, set up a passkey (sign-in with fingerprint, face recognition or security key) or an authenticator app and see your signed-in devices.

A code from an authenticator app serves as the second factor or, in the sign-in account management, a security key as well. A passkey replaces password and code.

How to set the rules

  1. Open Administration › Sign-in & security.
  2. Under Sessions, choose the Maximum session duration (12 hours by default, 8 hours or 4 hours) and the Sign-out after inactivity (1 hour by default, 30 minutes or 15 minutes) and click Save. The rules apply from the next page onwards to all people in your account.
  3. Under Second factor, turn on the second factor for each organisation with Make mandatory. The overview shows how many people have already set up a device. With Make optional, it becomes voluntary again.

Setting up single sign-on (from the Pro plan)

With single sign-on, people of your domains sign in via your company's sign-in service. Microsoft Entra ID, other services with OpenID Connect and SAML 2.0 are supported.

  1. Under Domains, enter the domain of your email addresses and click Add domain.
  2. In the DNS of your domain, create the TXT record shown (name and value) and click Check now. DNS changes can take a few hours.
  3. Under Single sign-on, enter the details of your service in Set up sign-in service and save.
  4. Carry out the Test sign-in. You do it as a Tenant Admin with an email address of your domains that is assigned to the application in your company's service. Nothing changes for other people yet.
  5. Set up emergency access: at least one Tenant Admin needs a password and a separate second factor for it, in the user menu under Second factor for emergency access (if a device is already set up: Another device for emergency access).
  6. Click Turn on.

Optionally, you set:

  • Sign in via the company only: people of your domains can no longer sign in with a password. Tenant Admins keep emergency access.
  • Our sign-in service requires a second factor: only confirm this if your service requires a second factor at every sign-in. Otherwise, Varmo additionally asks for its own code after the return if the second factor is mandatory.
  • Create account at first sign-in: people of your domains automatically receive access as “User” with the functional role Employees at their first sign-in, in the selected Organisation for new people. As long as they only have this role, they do not count towards the user limit of your plan; you assign further functional roles as usual.

With Pause, all people temporarily sign in with a password; with Turn back on, single sign-on applies again. People who were created automatically at their first sign-in do not yet have a password in Varmo; during the pause they set one on the sign-in page via Forgot password?.

What happens next

  • Anyone who breaches a session rule is signed out and sees the reason at the next sign-in.
  • If the second factor is mandatory, all people set up their device directly after their next sign-in; before that they see no data. This also applies to you.
  • After single sign-on is turned on, people of your domains are directed to your company's service at their next sign-in.
  • Changes to these rules appear in the Administration log.

Frequently asked questions

What happens after several wrong codes?

After 5 wrong codes within 15 minutes, code entry is locked for 30 minutes and the session ends. The member list under Administration › Members (see Inviting members and managing access) then shows “Sign-in locked”; a Tenant Admin lifts the lock with Unlock sign-in.

Can employees turn off the second factor themselves?

No. Whether the second factor is mandatory is decided by a Tenant Admin per organisation. For Tenant Admins, it can remain mandatory even if it is voluntary for the organisation.

What applies if our company's service fails?

Tenant Admins sign in on the sign-in page via Emergency access: sign in with password, with their password and the second factor for emergency access. If necessary, they pause single sign-on.