Sign-in methods
CyberOS supports four sign-in paths. Your tenant admin determines which are enabled in Tenant Settings → Authentication.Email + Password
Sign in with your registered email address and password. If your tenant has MFA required, you are prompted for a passkey or security key tap after your password is accepted.
Passkey (passwordless)
If you have enrolled a passkey or FIDO2 security key, you can sign in without typing a password at all. Your device or hardware key handles the authentication ceremony.
Google SSO
Click Sign in with Google on the login screen. No extra setup is required on your end — once your admin has connected your Google Workspace in Tenant Settings → SSO, the button appears automatically.
SAML 2.0 Enterprise SSO
If your company uses Azure AD, Okta, or Google Workspace as its identity provider, your admin can configure SAML 2.0 SSO. You are redirected to your company login page and land back in CyberOS after authenticating there.
Google SSO: Your tenant admin configures the Google Workspace IdP connection once in Tenant Settings → SSO. After that, everyone on your team simply clicks Sign in with Google — no individual setup needed.
Role-based access
Every account in CyberOS holds one or more roles. Your roles determine which modules you can open, which records you can create or edit, and which admin screens you can see. Roles are assigned by your tenant admin and are displayed on your profile page under Settings → My Roles.- Member Roles
- Admin Roles
- External Roles
These roles cover the typical day-to-day team member. Most people hold exactly one.
Your active roles are always visible at Settings → My Account → Roles. If you believe you are missing access, contact your tenant admin — role changes take effect immediately at next sign-in (or on token refresh within one hour).
Passkeys and MFA enrollment
CyberOS uses WebAuthn Level 3 (FIDO2) for multi-factor authentication. A passkey can be a device biometric (Face ID, Touch ID, Windows Hello) or a hardware security key (YubiKey, Titan Key). Once enrolled, your passkey serves as your second factor after a password login — or as a standalone passwordless credential.1
Open Security Settings
Navigate to Settings → Security → Passkeys & MFA. You see a list of your enrolled factors (empty if you have not enrolled one yet).
2
Start enrollment
Click Add passkey or security key. Give it a label (e.g. “MacBook Touch ID” or “YubiKey 5 NFC”) so you can identify it later.
3
Complete the browser ceremony
Your browser or operating system prompts you to tap your security key or use your biometric. Follow the on-screen prompt. The whole ceremony takes under 10 seconds.
4
Save your recovery codes
After enrollment, CyberOS generates 10 single-use recovery codes. Download or print them now and store them somewhere safe. Each code is 8 characters and can be used exactly once if you ever lose access to all your enrolled factors.
GeoIP travel policy
CyberOS monitors sign-in locations to protect your account from credential theft. When a login appears to come from a continent different from your previous sign-in, or moves faster than physically plausible, AUTH triggers a travel challenge. What you see when a travel challenge fires:“We noticed a sign-in from a new location. Please verify with your passkey or security key to continue.”You are not blocked — you are asked to confirm with your second factor. Once you pass the MFA challenge, the session proceeds normally. If your tenant’s policy is set to block unusual logins outright, you see:
“Sign-in blocked: unusual location detected. Contact your admin or try again from your usual network.”
Creating a travel policy exception
If you frequently travel and want to avoid repeated location challenges, ask your Tenant Admin or Security Admin to create an allowlist entry for the IP ranges you use while travelling (e.g. a hotel network or VPN exit node). Once added, logins from those addresses are treated as trusted and skip the travel check. Admins can manage allowlists at Admin → Security → Travel Policy → CIDR Allowlist.Session lifecycle and token expiry
When you sign in, CyberOS issues an access token (valid for 1 hour) and a refresh token (valid for 7 days). Your browser or desktop app manages this automatically — you stay signed in as long as you use CyberOS at least once every 7 days.What your session looks like
What your session looks like
Your active sessions are listed at Settings → Security → Active Sessions. Each entry shows the device type, approximate location, and last-seen time. You can revoke any session you do not recognise.
When tokens expire
When tokens expire
Your 1-hour access token is refreshed silently in the background every time you interact with the platform. If you close your browser for more than 7 days, your refresh token expires and you are asked to sign in again. No data is lost — only the session ends.
Revoking a session
Revoking a session
Go to Settings → Security → Active Sessions, find the session you want to end, and click Revoke. The session is invalidated immediately — any browser tab using that session is signed out within seconds. Admins can also revoke sessions for any member from Admin → Members → [member] → Sessions.
Signing out everywhere
Signing out everywhere
Click Revoke all other sessions on the Active Sessions page to instantly invalidate every session except your current one. Use this if you think your account has been compromised.
Audit log
Every authentication event is written to a hash-chained audit log — sign-ins, sign-out events, failed attempts, MFA challenges, travel flags, and role changes all appear here.- Members can view their own sign-in history at Settings → Security → Sign-in History.
- Tenant Admins can view the full tenant-wide auth audit log at Admin → Audit Log → Authentication.
Audit rows are immutable and hash-chained — no one can delete or alter them. The chain is anchored to the CyberOS memory module’s audit infrastructure for cryptographic verifiability.