reference · Reviewed 2026-11-02 GA

Security dashboard

The Security Dashboard is the one place that answers "how is this organization secured right now" without opening five settings pages. It is a read-only summary: everything on it is configured elsewhere, and the dashboard tells you the current state and where the exceptions are.

Find it at Organization Admin > Dashboards > Security. It is organization-only: there is no workspace equivalent, because the controls it reports on are organization-wide.

What each panel tells you

Panel	What it tells you
Access	A map of where members have been signing in from, with a View Access Log link through to the audit log. Mainly an anomaly check: a sign-in from a country you do not operate in shows up here before anyone goes looking
Members	Total organization members. The denominator for everything else on the page
Controls	Whether MFA, SSO Login, Password Policy and Session Expiry are in force. Four indicators, and any that are off are your gaps
IP Access Rules	Whether sign-in is restricted by IP range. Reads "No IP access rules are configured" when it is not
Secured Domains	How many email domains may sign up. Zero means signup is not domain-restricted, so an invited person can join with any address
Administrators	Every administrator with their role, plus View All Members. Worth re-reading periodically: admin counts grow quietly
Recent Signups	Who has just joined
Pending Invitations	Who was invited and has not accepted. Stale invitations are a small attack surface and a licensing question at once
Current Lockouts	Accounts currently locked out. First place to look when someone cannot sign in
Login Attempts	Sign-in activity including failures. A cluster against one account looks different from a cluster spread across many, and the difference matters
Data Transfers	Data movement in and out, which pairs with the transfer log for detail

The four Controls indicators are configured at MFA, Single Sign-On and Password Policy. IP Access Rules are set per workspace under access restrictions, so the organization can show none here while individual workspaces are restricted.

Using it as a review

The dashboard's value is that it is a checklist you cannot forget to run. A short periodic pass:

1. Controls: are all four on? If one is off, is that deliberate?
2. Administrators: is anyone here who should not be, and are there more than the work needs?
3. Pending Invitations: anything stale enough to withdraw?
4. Current Lockouts: anyone stuck?
5. Secured Domains: should signup be domain-restricted?

It reports, it does not enforce

Nothing on this page is a control. Every item is configured on its own page, and the dashboard only reflects that configuration. Changing something means going to the underlying page, and the dashboard will catch up.

Related

• Audit and transfer logs — the detail behind the Access and Data Transfers panels
• Multi-factor authentication — one of the four Controls indicators
• Single sign-on — another
• Password policy — the third
• Access restrictions — where IP rules are configured
• Organizations & Workspaces — the portal split, and which settings are organization-only