Security
Security logs and alerts help you to keep your Workplace community safe. Find out more about security by visiting the Customer Resource Center.
The Security section of your Admin Panel gathers all the information available on your Workplace's security into one place, making it easier to access and monitor.
Your security center is organised into key security and authentication settings, a security dashboard and your security logs. It can only be accessed when logged in from a computer.
Settings
The Settings button at the top of the security center is where you will go to enable video download, two-factor authentication and certification features.
- Require Two-Factor Authentication - Turning this toggle on will add a Two-factor tab to your security center. From that tab, you can choose to require two-factor authentication for all accounts, admins, or those that belong to specific People Sets. Find out more about two-factor authentication.
- Video Download Settings - Turning this toggle on will add a Video download settings tab to your security center. From that tab, you can turn off video downloads on your Workplace and ensure that those who are not using supported browsers are not able to access video content at the highest quality. Find out more about video download settings.
- Certifications - Turning this toggle on will add a Certifications tab to your security center. From this tab, you can download the latest third-party reports on Workplace data security. Find out more about certifications.
Dashboard
The security dashboard gives you an overview of two-factor authentication adoption, login failures and other security events. You can also see how many of your Workplace accounts we believe to be at risk of being compromised, and an overall health rating for your Workplace's security.
Log
The log tab enables you to view all login, password, admin, file and integration activity from the past 90 days. You can download the logs or browse them in Workplace.
Find out which events are recorded and how they appear in your security logs.
Authentication
The authentication tab is where you can find settings related to single sign-on (SSO) and your SSO provider. You can also allow your community to sign in to third-party applications using their Workplace login.
Find out more about single sign-on on Workplace.
Workplace security logs keep a record of all security events. Below is a list of all the events we currently record, alongside an explanation of the event that's occurred.
| Event Name | Note |
| Logged in | A user has successfully logged in using either password or SSO. |
| Login Failed | A user has unsuccessfully tried to log in. |
| Logged out | A user has logged out. |
| Password Changed | A user has changed their Workplace password. |
| Password Reset Succeeded | A user has reset their Workplace password by setting a new password. |
| Password Reset Code Requested | A user's Workplace password has been requested for reset through the self-service flow. |
| Password Reset Incorrect Code | The verification code required to reset a user's Workplace password has been entered incorrectly. |
| Account at Risk | We've found a user whose account is at risk. Learn more on how to identify accounts at risk. |
| Account Set To Unclaimed | An admin or integration has set a user to unclaimed. |
| Forced Logout | An admin has forced a user to log out via the admin panel. |
| Account Deactivated | A user has been deactivated through an admin or an integration. |
| Account Activated | A user has been activated through an admin or an integration. |
| Account Deleted | A user account has been deleted. |
| Forced Password Reset | An admin has forced a user's password to be reset before next login. |
| Account Created | A user account has been created by an admin. |
| Accounts Created | An admin has created user accounts with the excel import method. |
| Admin Role Changed | An admin account has had its role modified. |
| Admin Removed | A user account has had its admin role removed. |
| Admin Created | A user account has been created through the Administrators section and has been promoted to an admin role. |
| Account Promoted to Admin | An existing user has been promoted to admin. |
| Email Changed | A user's email has been edited. |
| Domain Added | A domain has been added to the verification table, but has not been verified yet. |
| Domain Verified | A domain has been verified successfully. Learn more on domain verification. |
| Domain Removed | A domain has been removed from Workplace. |
| Two-Factor Authentication Enabled | A user has self-enrolled in two-factor authentication. Learn more on how this is enabled. |
| Two-Factor Authentication Disabled | A user has disabled their two-factor authentication. |
| Phone Number Added | A user has added a phone number against their account. |
| Two-Factor Code Entry Succeeded | A user has successfully entered in their two-factor authentication code when prompted on our desktop or mobile site. |
| Two-Factor Code Entry Failed | A user has unsuccessfully entered in their two-factor authentication code when prompted on our desktop or mobile site. |
| Two-Factor Code Entry Succeeded On Mobile App | A user has successfully entered in their two-factor authentication code when prompted on either our Android or iOS app. |
| Two-Factor Code Entry Failed On Mobile App | A user has unsuccessfully entered in their two-factor authentication code when prompted on either our Android or iOS app. |
| Group File Downloaded | A file has been downloaded from a group. |
| Group File Uploaded | A file has been uploaded to a group. Learn more on how to upload a file to a group. |
| Malware Suspected in File | A file has been suspected of having malware and has been blocked from being uploaded to a group. |
| Integration Created | A custom integration has been created. |
| Integration Edited | A custom integration has been edited. |
| Integration Deleted | A custom integration has been deleted. |
| Integration Added | An app from the integration directory has been added. |
| Integration Removed | A integration directory app has been removed. |
| Multi-Company Group Created | A multi-company group has been created. |
| Joined Multi-Company Group | A user has joined a multi-company group. |
| Created users via IDP Sync | Users have been created via a connected identity provider (Azure or G Suite). |
| Created Users via Coworker Invite | Users have been created through invites initiated by other community members. |
| Invited Coworker | Users have been invited through invites initiated by other community members. They're only created once they accept the invite. |
| Compromised Credentials Found | An account was found to have compromised credentials for username/password authentication. |
| Company Marked as Resold | |
| Malware Upload Blocked | A malware found in a file upload was blocked. |
| Profile Data Download Requested | A user put in a request to download their data. |
| Report Former Employee | Persisted events from former employee reports. |
| Reseller Added | Enabled insights tab for non-admin user. |
| Reseller Removed | Disabled insights tab for non-admin user. |
| Reseller Invite Sent | A company has been invited to be linked |
| Reseller Invite Accepted | Invited company to be linked has accepted the invite |
| Reseller Invite Declined | Invited company to be linked has declined the invite |
| Self Invite Created | A user created their account using self-invite. |
| SSO Reauthentication | An admin requested SSO Reauthentication from their users. |
| Two-Factor Authentication Enabled | Two-factor authentication was enabled for a user. |
| Two-Factor Code Entry Failed | A two-factor authentication code entry failed upon validation. |
| Two-Factor Code Entry Failed On Mobile App | A two-factor authentication code entry failed upon validation on the mobile app. |
| Two-Factor Code Entry Succeeded | A two-factor authentication code entry succeeded upon validation. |
| Two-Factor Code Entry Succeeded On Mobile App | A two-factor authentication code entry succeeded upon validation on mobile app. |
| User Invited | A two-factor authentication code entry succeeded upon validation on the mobile app. |
| Integration Access Token Reset | An integration access token was reset. |
| Profile Data Downloaded | A user downloaded their data. |
| Two-Factor Authentication Disabled | Two-factor authentication was disabled for an user. |
| Reported Content | A user has reported a post for the admin to review. |
| Video Downloaded | A user has downloaded a video |
| Profile Automaticatically Deleted | A user account has been deleted automatically after being unclaimed for 27 days or more. |
Admins can save the searches they make in the Security Log. To save a search:
- From your News Feed, click
Admin Panel in the left menu.
- Click Security.
- Select Log.
- Type in your search criteria and select Save Search.
- Saved Searches appear on the right side of the page.
We'll let you know if we suspect that some of the user accounts in your community may be at risk. You'll receive a notification that says a security risk has been detected, and the dashboard in your Security tab will show at risk accounts. Given that there's a small risk that an attacker could use password information to access your Workplace community, we recommend that you disable these users or force them to reset their passwords.
To see which accounts may be at risk:
- From your News Feed, click
- Click People.
The Security Health score takes into account various pieces of information about your community's security activities.
To see your Security Health score:
- From your News Feed, click
- Click Security.
The overall security level is based on the security events of the last 30 days and the security features you've set up as well as any security threats we've detected. We'll notify you about issues that need your attention. Learn more about what information you can find in the Security tab.
