Security
Web vs mobile: Mobile supports personal MFA, passkeys, session management, and read-only login history. Staff Entra SSO setup is on the web at admin.partnerone.dev/sso. See Set up Microsoft Entra SSO.
Navigation: More → Settings → Security, Sessions
PanelOne Mobile uses the same staff account as the web app. You must set up and use a second factor to use the app — your organisation can't switch MFA off.
Overview
Security features on mobile cover:
| Area | Mobile | Web-only |
|---|---|---|
| MFA enrollment | Yes | — |
| Passkey registration | Link to Admin | admin.partnerone.dev |
| Active sessions | View and revoke | — |
| Login history | Read-only | — |
| Passkey audit log | Read-only | — |
| Staff Entra SSO setup | Link to web | admin.partnerone.dev/sso |
Multi-Factor Authentication (MFA)
You must set up and use a second factor to use the app. A password sign-in can succeed and then send you to enrol or challenge you.
- First sign-in: set up an authenticator app and save your recovery codes (they are always shown after enrolment).
- Later sign-ins: PanelOne Mobile requires an authenticator-app code. Passkey-only staff are refused and told to enrol an authenticator.
- Lost your authenticator? See Recover access with a recovery code.
Managing MFA
Navigation: More → Settings → Security
| Action | Steps |
|---|---|
| View MFA status | Open Security settings |
| Set up authenticator | Follow the first-sign-in walkthrough if you have not enrolled yet |
| Recovery codes | Issued after enrolment; use one to reset MFA — see recovery |
Passkeys
A passkey works as the second factor on PartnerOne Admin and the login site only. PanelOne Mobile requires an authenticator-app code. Register a passkey from PartnerOne Admin — see Passkeys.
Passkey Audit Log
Navigation: More → Settings → Security → Passkey audit section
Read-only log of passkey registration and authentication events — useful for security reviews.
Sessions
Navigation: More → Settings → Sessions
View and manage active sessions across devices:
| Element | Description |
|---|---|
| Current session | Highlighted — this device |
| Other sessions | Browsers and devices with active tokens |
| Revoke | End sessions you don't recognize |
| Session details | Device type, last active, IP (when available) |
Revoking another device's session signs it out immediately on next request.
Session Timeout
Organization session timeout policy is configured on web. Mobile sessions respect the same timeout rules — you may see re-authentication prompts after idle periods.
Login History
Navigation: More → Settings → Security → Login history section
Read-only list of recent sign-in events:
- Timestamp
- Success or failure
- Method (password, passkey, MFA)
- IP address and device hints (when logged)
Use login history to audit account access after lost devices or credential concerns.
Sign-Out Data Purge
Signing out clears:
- Session tokens stored on the device
- Offline read cache
- Active and dead-letter write queues
This ensures no operational data persists on a shared or lost device after sign-out.
Security Console (SentinelOne)
For SentinelOne-specific security operations beyond personal account security:
Navigation: More → Security & threats → SentinelOne sub-console
Includes mobile S1 hub sections for threat browse and vendor-specific actions. Full vendor admin remains on web.
Tips & Best Practices
- Complete MFA on every sign-in — You must set up and use a second factor to use the app.
- Register a passkey from PartnerOne Admin if you want one for Admin and the login site. PanelOne still needs an authenticator.
- Review sessions monthly — Revoke stale browser sessions.
- Check login history after travel — Confirm no unexpected sign-ins.
Related Guides
- Getting Started — First sign-in and MFA
- Settings — Team and permissions
- Security (web) — Staff sign-in security
- Set up Microsoft Entra SSO