> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in security and password requirements

> Password rules for email sign-in, what happens at sign-in when SSO is enabled, and which security controls your identity provider handles

Users sign in to Profound with an email address and password, or through your identity provider (IdP) with [Enterprise Single Sign-On (SSO)](/platform-config/authentication/sso-overview). For password accounts, Profound applies its own rules. For SSO users, multi-factor authentication (MFA), device requirements, and password rules live in the IdP.

## Password requirements

Profound checks the password when a user creates an account, accepts an invitation, resets their password, or changes it in their account settings. A password must:

* Be at least 12 characters long.
* Be [secure](#what-makes-a-password-secure).
* Not match a password the user has used in Profound before.

The same rules apply to every organization. Profound doesn't offer per-organization password policies.

<Note>
  MFA isn't currently available for password sign-in. To require a second factor, [set up Enterprise SSO](/platform-config/authentication/configure-sso) and enforce MFA in your IdP.
</Note>

### Change or reset a password

To change a password, open **Settings** from the organization name menu at the top left of the screen, then select **Account** > **Profile** and update **Password**.

Profound asks for the current password, and the new password must differ from it. The **Password** row appears only when your current session started with a password. If you signed in through SSO, the row is hidden even if your account has a password.

To reset a forgotten password, select **Forgot password?** on the sign-in page, and Profound emails you a reset link.

### What makes a password secure

A secure password is long and hard to predict. Profound treats the following as easy to guess, even when they meet the length requirement:

* Dictionary words, names, and well-known passwords such as `password1234`.
* Personal details such as a birthday, a username, or part of an email address.
* Keyboard patterns such as `qwertyuiop`, sequences such as `123456789012`, and repeated characters such as `aaaaaaaaaaaa`.
* Simple variations of any of these, such as capitalizing the first letter, swapping letters for similar-looking symbols, or adding a number at the end.

<Tip>
  Length and unpredictability count for more than mixing character types: A passphrase made of several unrelated words, such as `harbor-violin-cactus-thread`, is stronger than a short password with symbols in it, such as `P@ssw0rd!`.
</Tip>

## Sign-in when SSO is enabled

When a user enters their email address on the sign-in page, Profound checks the sign-in policy for that address before asking for a password:

* **SSO required**: users whose email domain is one of your organization's verified domains go straight to your IdP.
* **SSO optional**: if your organization has an SSO connection but doesn't require it, users choose **Continue with SSO** or **Continue with password**.
* **Other domains**: users whose email domain isn't one of your verified domains, such as agency or contractor accounts, keep signing in with an email address and password. Learn how to provision these users alongside your directory in [Directory Sync](/platform-config/people/directory-sync).

[Enabling SSO](/platform-config/authentication/configure-sso) turns off password sign-in for users on your verified domains, so they go straight to your IdP. To allow password sign-in alongside SSO (for example, during a rollout), contact [customer support](mailto:support@tryprofound.com).

Users who have only ever signed in through SSO have no Profound password. If password sign-in is allowed for them later, they select **Forgot password?** on the sign-in page to set the password.

## Controls your identity provider handles

With Enterprise SSO, your IdP authenticates the user and Profound accepts the result. Profound doesn't configure, enforce, or verify any of the following, so set them up in your IdP:

* MFA.
* Managed-device requirements: use your IdP's conditional access or device trust policies.
* Network or location restrictions: use your IdP's conditional access policies.
* Password rules for SSO users: length, history, expiry, and lockout policies.