Security

Tenant Administrators can access user security settings by navigating to the Settings icon in the upper right corner of the screen.

Click on the Security tab under the Tenant section to access the Tenant Security Configuration page.

Canopy supports Multifactor Authentication (MFA) via email and virtual devices supporting Time-based One-time Passwords (TOTP). The default setting for MFA is email authentication.

Email Authentication

Tenant security settings default to Email authentication when onboarding users and transitioning MFA devices.

Canopy recommends that you use email authentication only for the periods of initially configuring and switching virtual MFA devices.

Authentication App

Tenant Administrators can switch to the Authentication App setting for user authentication following initial configuration.

When set to Authentication App, added users will automatically be prompted to set a password and login. After logging in, the option to Set Up Virtual MFA Device will appear under Personal Settings when hovering over or clicking on the Settings icon.

Users can then follow the prompts to set up virtual device authentication to use for future logins (see Personal Settings for detailed instructions).

Authentication App Key Icon

When the admin has configured MFA security settings to the Authentication App, the Key icon will appear beside users who have set up their virtual MFA device.

The Key icon is only present on accounts protected with a virtual MFA device:

See How to Revert from Authenticator App to Email Authentication.

1. Sign in as a Tenant Administrator.
2. In the upper right corner of any page on Canopy, click the Settings icon, and then under Tenant, click Security.
3. To the right of Multifactor Authentication, click on the dropdown box and select either Email or Authentication App.
4. Configuration completed.

Once added to the system, new users will automatically receive a Canopy welcome email directing them to click a button to create a password.

Users will be directed to enter and confirm a password.

When MFA is set to Email authentication, new users will then be prompted to enter an email authentication code.

A Canopy multifactor authentication email with a code to use to login to Canopy will be automatically emailed to new users.

Tenant Administrators can set an inactivity timer (1-60 minutes) before the system automatically logs users out and can also disable an inactive user after a set number of days (1-22 days).

1. Sign in as a Tenant Administrator.
2. In the upper right corner of any page on Canopy, click the Settings icon, and then under Tenant, click Security.
3. To the right of Log Out User, type in a number from 1 to 60 to specify the number of inactive minutes that are allowed until the system automatically logs out the user.
4. To the right of Disable User, type in a number from 1 to 22 to specify the number of inactive days that are allowed until the system automatically deactivates the user’s account.
5. Configuration completed.

After a tenant is provisioned, it is accessible by anyone from any computer. Tenant administrators can then restrict tenant access by IP address.

Users will still need to provide credentials to access the tenant.

Restrictions are associated by domain and role. For example, a Review Manager may want to restrict Light Reviewers from any domain by an IP address range originating from their corporate network.

When a request to the tenant is generated from any user, that user’s IP address, domain, and role are evaluated against the allowed list. If their IP address is not on the list, an HTTP 403 status code is displayed.

Only Tenant Administrators have the ability to add or remove IP addresses.

You must specify a public IP address that can be accessed by the website. Private IP addresses cannot be accessed by the website.

1. Sign in as a Tenant Administrator.

2. In the upper right corner of any page on Canopy, click the Settings icon, and then under Tenant, click Security.

3. To the right of Access Restrictions, click on the + Add Restriction button.

4. To add a restriction, create a unique name for each restriction. Then choose the domain and tenant level role you would like restricted by IP address.

   

   

   

5. Click on the info button beside Add IP Addresses to check IP address format details.