Manage account security
Operate managed passwords, mandatory authenticators, session expiry and administrator-assisted recovery without bypassing identity checks.
Passwords and authenticators
Managed sign-in requires a password or an explicitly linked Google identity plus an authenticator code. Passwords accept 15–128 Unicode code points and a local common-password check.
Use Account security to change your password. Supply the current password and a fresh authenticator code. Changing a password ends existing sessions.
Sessions
Sessions expire after 30 minutes of inactivity or eight hours absolutely. Sensitive account changes require authentication within the last 15 minutes.
Suspension, role changes, auditor expiry and credential resets invalidate sessions. An expired challenge does not grant application access; restart sign-in.
Lost authenticator
Another admin must independently verify the person's identity before resetting MFA. The reset is audited, ends sessions and requires new authenticator enrollment.
There is no public password-reset or MFA-bypass path. Retain a protected authenticator backup and a second administrator. The last enabled managed administrator cannot be removed or suspended.
See user invitations and Google sign-in.
Singapore PDPA evidence
Organize Singapore PDPA-mapped controls and evidence while retaining the organization's privacy decisions and operating records.
Configure Google sign-in
Link Google identities to invited managed users while keeping explicit Sparta roles and mandatory authenticator verification.