Team settings
Manage team → Settings is where organisation-wide policies are configured. The page is only available to users who manage the team (team.manage).
Default permissions
New users can start with a baseline set of team permissions. A table lists every team permission with an Is default checkbox. Changing a box updates the team’s defaultPermissions immediately so hires inherit sensible access without a manual click through every key.
Defaults do not replace trial-level setup: collaborators still need trial personnel or trials.manage as described in User management.
Single sign-on (SSO)
Trialflare supports Google Workspace and Microsoft Office 365 / Entra ID on the login page. Two optional rules automatically add users to your team the first time they sign in:
- Email suffix — If everyone uses the same domain (e.g.
@company.com), enter the suffix (e.g.company.com). Only root-level operators can edit this field in some deployments; others may be read-only. - Entra ID tenant ID — Provide your directory tenant UUID so accounts in that tenant join your team on first login.
If neither rule is set, people must receive a normal team invitation before SSO can bind them to your tenant.
Use Save single sign-on configuration after editing allowed fields.
People who sign in with Google or Microsoft and haven't chosen a profile image get their photo from that account, updated each time they sign in. Anyone can replace or remove it from the Profile tab of their account settings, after which it is no longer updated.
Password policy
Per-team complexity rules apply to password-based logins for users belonging to your team. You can set minimums (leave blank for no rule):
- Minimum length
- Minimum capitals
- Minimum special characters
- Minimum numbers
Save password policy persists these values.
Lockout policy
Optionally lock accounts after N unsuccessful login attempts (blank disables). A locked account can't sign in any way — password, passkey, or Google or Microsoft sign-in — until an administrator resets it. The counter resets after a successful login. Save lockout policy uses the same save path as password rules in the app.
Inactivity sign-out
Sign sessions out after a period with no activity — between 5 minutes and 24 hours — so an unattended browser does not stay signed in. Each device's session is timed separately, and a session signed out this way is recorded in the team's event log (sessionExpired). Leave the field blank for no limit. Studies run to GCP typically use 15–30 minutes.
User sign-up notifications
Enter an email address to receive a message whenever new users are created in the team, or leave it blank to disable. Save notification email address stores the setting.