# Set sign-in and domain security options

To change security for your domain, open Edit Domain, click the **Option** tab, and set the security switches: **Allow Dual Authentication**, **Enable Forgot Password**, **Allowed Country**, link alerts, DLP and more. Click **View / Save Changes**, then **Save**. Sign-ins from countries you did not list are refused.

## How to set sign-in and domain security options

1. Open **Edit Domain** for your domain and click the **Option** tab.
2. Switch on the security options you need, for example **Allow Dual Authentication**.
3. To limit sign-in by country, pick one or more countries in **Allowed Country**.
4. Click **View / Save Changes**, check the list, then click **Save**.
5. To also push the countries to every existing user, click **View / Update Geo Location**, switch on **Allow Geo Location to All Users** and click **Update**.

## Options

| Option | What it does |
|---|---|
| **Allow Dual Authentication** | Shows the two-step login option in your users' Settings so they can switch it on. It does not force anyone to use it. |
| **Enable Forgot Password** | Lets users reset their own password from the sign-in page. |
| **Disable change password** | Switches off the change password option in users' Settings. |
| **Enable link/url security Alert** | Checks every link in mail for fake or harmful sites and warns the user in webmail. |
| **Data Loss Prevention (DLP)** | Turns on data loss prevention for the domain. |
| **Allowed Country** | The countries from which user accounts can be reached. The default is **ANYWHERE**. Picking **ANYWHERE** clears any other choice. |
| **View / Update Geo Location** | Opens a window showing the old and new country list. Switch on **Allow Geo Location to All Users** to copy the list to every existing user, then click **Update**. This saves the countries at once. |

## Example

> The admin at acme.in picks **India** in **Allowed Country**, switches on **Allow Dual Authentication** and **Enable link/url security Alert**. Anita then turns on two-step login in her own Settings.

## Good to know

- Countries are saved to the domain when you save the tab. Users who already exist keep their own country list unless you use **Allow Geo Location to All Users** or **Apply To All Users**.
- With **Apply To All Users**, the dual authentication choice is also pushed to existing users who have an alternate email or a mobile number saved.
- Set the allowed IP addresses for users on the allowed IP ranges page.
- Password strength and sign-in blocking rules sit under Policy, not in this tab.

## Common questions

**How do my users start using two-step login?**

Switch on **Allow Dual Authentication** and save. This shows the two-step option in each user's Settings. Each user then turns it on for themselves in Settings, under Security.

**What happens when someone signs in from a country I did not allow?**

The sign-in is refused. There is no one-time-code fallback, so add the country first if staff travel.


Source: https://docs.xgenplus.com/admin/domain-security/