Workspace security

Scope, access, and protection mode

Open Settings, choose a non-personal workspace, and select Security. Members who can reach the page may review the policy, but only workspace admins can save changes or perform the privileged recovery and trust actions shown to them.

The workspace protection mode is fixed when the workspace is created. The Security page reports that mode and configures access around it; it does not convert an existing workspace to another protection mode.

Sign-in, MFA, and step-up policy

• Allowed sign-in methods controls which listed account sign-in methods may be used for this workspace.
• MFA policy can be optional, required for everyone, or required for admins. A passkey counts as a verified authenticator for policies that require MFA.
• Step-up TTL sets how long an extra workspace verification remains valid before it is requested again.

Allowed sign-in methods

Limits which account login methods members may use when entering this workspace. Keep at least one method that current admins can use.

MFA policy

Optional applies no workspace-wide requirement; Everyone requires it for all members; Admins requires it for workspace administrators.

Network or country mode

Off ignores the rule; Audit records an evaluation; Challenge can ask for extra verification; Block can deny workspace access.

Step-up validity

How long a successful extra verification remains valid before Quill asks again for protected workspace actions.

Save an access policy safely

1. Review the current sign-in methods, MFA rule, location modes, and administrator access path.
2. Make the smallest required policy change and validate every network range or country selection.
3. Choose Save policy and wait for the saved confirmation before leaving.

After completion: The policy shown on the page becomes the workspace access rule. Members are evaluated against it on later protected access; saving does not sign everyone out immediately.

Network and country rules

IP and country rules have four modes: Off does not apply the list, Audit records evaluation without interrupting access, Challenge can require extra verification, and Block can deny access. Country allowlists apply only after at least one allowed country is selected.

Network ranges use CIDR notation. Allowed ranges form an enforced allowlist when the network mode applies; trusted ranges can reduce repeated verification. Save the policy only after checking the entries and keeping an access path for administrators.

Workspace session trust

The trust list shows workspace-specific trust records with the member or device, state, location summary, expiration, and last evaluation. Revoke one record when a device or access context is no longer trusted, or revoke all records after a broad policy or security concern.

Administrator access recovery

For an eligible encrypted workspace, an active admin can approve a pending request from another admin who lost access. If no accessible admin can approve, an authenticated active admin can use the workspace recovery key and receives a rotated replacement key after successful recovery.

Recover administrator access

1. Open the recovery area for the selected encrypted workspace and identify the pending administrator request.
2. If another active admin still has access, that admin reviews and approves the request. Otherwise, an active admin uses the current recovery key in Recovery Center.
3. After recovery succeeds, save the newly displayed replacement key securely offline and discard the previous key.

After completion: The administrator regains access without changing membership or role, and the old recovery key no longer works.