Enforce strict access controls, multi-factor verification, and definitive accountability for all console administrators.
Network segregation for management
Restrict inbound traffic to the ePO console port (default 8443) using network firewalls. Permit access only from trusted administrator subnets or a dedicated management jump host.
User and role management
Eliminate shared accounts: Assign a unique login credential to each administrator. Do not share accounts.
Restrict global admin use: Prefer to use granular administrative accounts for daily operations as much as possible and limit the use of the ePO Global Administrator account.
Apply Role-Based Access Control (RBAC): Assign users the minimum permissions required for their specific tasks, and restrict console access to designated groups or regions within the System Tree.
Logon protection and server policies
Configure these controls under Menu → Configuration → Server Settings → Logon Protection:
Account lockout: Enable account lockout after 5 failed logon attempts. Set the lockout duration to 30 minutes. For details, see Locking out user accounts to protect your server.
Automatic IP restriction: Enable automatic IP restriction to block any IP address that triggers more than 10 failed logon attempts within 60 seconds.
Session timeouts: Set the user session timeout interval to 15 minutes of inactivity to prevent exposed management sessions.
Password policy: If using native ePO authentication, enforce a strong password policy. Set a minimum length of 14 characters, a history of 24 remembered passwords, and an expiration interval of 90 days.
Note
Native password policies do not apply to external authentication methods such as Microsoft Entra ID, Windows Authentication, Certificate-Based Authentication, or SAML single sign-on (SSO). Manage password complexity directly within those external identity systems.
Advanced access security
Enforce MFA: Integrate ePO with your Identity Provider (IdP) via SAML to enforce Multi-Factor Authentication (MFA) across all console logins. For single sign-on setup instructions, see Logon to ePO - On-prem using Identity Provider.
Enable approvals: Turn on Policy and Task Approvals to require a secondary administrative review before deploying tasks or modifying security policies.
For workflow authorization steps, see Policy approval management and Configure approval settings for Task changes.
Automate incident responses: Create Automatic Responses to trigger immediate alerts (e.g., via email or syslog) for high-risk security events, such as Logon Protection activations or unauthorized policy modification attempts. For details, see Setting up automatic responses.