Security

Security settings cover your sign-in credentials and your organization’s password and single sign-on policy. They sit in one dialog reached from the User Profile menu, served from id.testsigma.com rather than the Arcus by Testsigma app, and they split into 2 groups. User settings cover your own account and are available to every user. Organization Settings apply to everyone in the account and need administrator access.

Setting	Group	Who changes it
Profile	User settings	You, for your own account
Change Password	User settings	You, for your own account
2FA	User settings	You, for your own account
Password Policy	Organization Settings	An administrator, for everyone
Security (SSO)	Organization Settings	An administrator, for everyone

Your profile

1. Click the User Profile menu, then select Profile.

2. Edit your First Name and Last Name. Both are required.

3. Click Update.

Your email address appears alongside them and isn’t editable here, since it identifies the account. To change your profile picture, click the pencil icon on the avatar.

Change your password

1. Click the User Profile menu, then select Change Password.

2. Enter your Current Password.

3. Enter the new one in New Password.

4. Enter it again in Confirm Password.

5. Click Update.

Note

A new password can’t match any of your last 8 passwords. The panel states “Your new password should not be same as your last 8 passwords.”

Two-factor authentication

Two-factor authentication asks for a one-time code from an authenticator app alongside your password. You enable it for your own account, and you need an authenticator app installed before you start.

1. Click the User Profile menu, then select 2FA under User settings.

2. Turn on the Two-Factor Authentication toggle. The Confirm Your Password dialog opens.

3. Enter your password and click Continue.

4. In the Set Up Authenticator App dialog, scan the QR code or enter the setup key in your app, then click Continue.

5. Enter the 6-digit code from your authenticator app in Verify Authenticator App, then click Continue.

Note

Phone numbers used for authentication are managed under Settings > Phone Numbers (TFA).

Password policy

The password policy sets 3 account-wide controls. Each is enabled separately, so you can use one without the others.

• Idle Session Timeout (minutes): signs an inactive user out after this many minutes.
• Max Failed Login Attempts: locks the account after this many consecutive failed sign-ins.
• Password Change Frequency (days): requires a new password after this many days.

To set them:

1. Click the User Profile menu, then select Password Policy under Organization Settings.

2. Click Configure.

3. In the Configure Password Policy dialog, select each setting you want to enable.

4. Enter the value for each one you selected.

5. Click Update.

Single sign-on

Single sign-on points authentication at your identity provider, so users sign in with existing corporate credentials and Testsigma accepts a secure token instead of a password.

Five providers are supported: Google, and the SAML-based Okta, Azure, OneLogin, and Google Workspace.

Only one SSO configuration can be active at a time, so enabling a second replaces the first. Verify a new configuration with one account before applying it to the organization.

Note

Turning on single sign-on makes it compulsory. The panel states “Your team members will be mandatorily required to sign in via SSO to access this site.”

Google

1. Click the User Profile menu, then select Security (SSO) under Organization Settings.

2. Turn on the toggle on the Google widget. You and your teammates can then sign in with Google from the next sign-in onwards.

Note

The toggle is unavailable unless you’re signed in to G Suite. The panel offers a link to sign in.

SAML providers

Okta, Azure, OneLogin, and Google Workspace all use SAML, so the exchange has the same 3 stages whichever you use.

1. Click the User Profile menu, then select Security (SSO) under Organization Settings.

2. Turn on the SAML widget to get its configuration values.

3. Create an application at the identity provider using those values.

4. Bring the provider’s certificate and URLs back into Testsigma.

The terms the provider’s own screens use:

• Service Provider (SP): Testsigma.
• Identity Provider (IdP): Okta, Azure AD, OneLogin, or Google Workspace.
• Single Sign-On URL: where authentication requests are sent.
• Audience URI (SP Entity ID): the unique identifier for Testsigma, usually a URL.
• Default RelayState: where users land after authenticating.
• Name ID Format: the format of the user identifier in the assertion, usually an email address.
• SAML or X.509 certificate: verifies the identity of both parties in the exchange.

For Azure, the values Testsigma needs on the Basic SAML Configuration screen are:

Entity ID:    https://id.testsigma.com/saml/<id>/metadata
Sign on URL:  https://id.testsigma.com/saml/<id>/callback
Relay State:  https://id.testsigma.com/
Logout URL:   leave empty

Replace <id> with the SAML ID from your Testsigma SSO panel.

Note

Users have to be assigned to the Testsigma application at the identity provider before they can sign in through it. Creating the application isn’t enough. On Okta this is Assign > Assign to People, and on Azure it’s Assign users and groups on the enterprise application.

Sign in with SSO

1. Click Sign in with SSO on the Testsigma sign-in page.

2. Enter the email address configured with SSO for the account, then click Sign in.

Note

The email address has to be configured for SSO first. Okta requires its mobile app for the first authentication.

Turn off single sign-on

1. Turn off the SAML toggle.

2. Click I Understand and Disable in the warning prompt.

Note

Disabling SSO removes the configuration rather than pausing it. Re-enabling means configuring the provider again from the start.

What SSO changes

Once SSO is on, sign-in happens at your identity provider, so account lockout, password rotation, and any multi-factor requirement are governed there. The Testsigma password policy stops being the control that matters for those users.

Related security controls

Three more controls sit outside this dialog.

• Support access grants the Testsigma support team temporary, logged, revocable access. See Manage access.
• Audit logs record who changed what and when, including authentication and access events. See Audit logs.
• IP whitelisting lets Testsigma’s cloud reach an application behind your firewall.

Roles decide what a signed-in user can do, and are assigned per project.