Login Options
Formalize supports several authentication methods. Please note that you must create users in the platform before they can log in using any of these methods. If you need help adding new users, refer to our guide on User Management.
You can enable or disable specific login methods by checking or unchecking the boxes next to each option in the Login options section in Settings -> Users & access.
Email & Password Login
Email and password is the default login method. Passwords are stored securely using bcrypt (12 rounds) and must meet the following strict complexity requirements:
At least 12 characters long
At least 1 lowercase letter
At least 1 uppercase letter
At least 1 number
At least 1 symbol (e.g., #, &, or /)
Must not match your previous password
Must not be a compromised password
Login with Google or Microsoft
Formalize supports Google and Microsoft Active Directory (AD) sign-in via the OAuth 2.0 protocol. When enabled, buttons for Google or Microsoft sign-in will appear on the login page.
However, you cannot automatically create new user accounts via Google or Microsoft sign-in. You must create the user in Formalize first before they can authenticate using these services.
Login with SAML
Formalize supports the SAML 2.0 protocol for almost all identity providers (IdPs). We do not provide any default SAML 2.0 identity providers, but you can add and configure new ones yourself.
Currently, only IdP-initiated authentication is supported. This means the user must first sign in directly to your identity provider before being redirected to Formalize.
Supported providers you can configure via SAML 2.0 include:
AWS
Google
Microsoft
Ping Identity
Whitelisted IP addresses for login
You can restrict administrator access by allowing specific IP addresses. When enabled, Admins can only log in from approved IPs, which safeguards the system from unauthorized remote access.
Multi-Factor Authentication (2FA)
2FA adds an additional verification step during login. Users enter their password and then confirm their identity using a one-time code sent via SMS.
Administrators have two options for 2FA:
Allow users to enable 2FA individually on their own accounts.
Enforce 2FA for everyone by checking the Enforce 2FA for all users at first login box in your Security Settings
Security Logs
System logs record security-related events, including all login activity. You can view successful and unsuccessful login attempts, along with details explaining why any attempts failed.
Each system log entry includes the following details:
User ID
User email
Date and time
IP address
Event type
User agent
We hope this article was helpful!
If you have any additional questions, please reach out to us via chat in the bottom right corner of the page — our team is always happy to assist you further.