# Audit Log, Two-Factor, and SSO for Business Account

Every change recorded by user and time, two-factor enforcement, and SSO for your Business Account on Enterprise.

These three controls decide how your team gets into your Business Account and record what they do there. The audit log starts recording when your first invitations go out. Two-factor and SSO decide how your team signs in.

[Octo](https://begenuin.com/developers/get-started/any-business/octo-operates-your-business-account-octo-proposes-you-approve), Genuin's Supervised Intelligence interface in your Business Account, proposes this capability when it finds a fit on your sites and apps. It completes the steps under Set it up from your brand context. Nothing goes live until you approve it. It's part of [Control](https://begenuin.com/developers/browse-by-products/control/control-what-it-does-and-where-to-start), and [Security, data residency, and compliance](https://begenuin.com/developers/get-started/any-business/security-data-residency-and-compliance) explains how these controls fit with Genuin's other security measures.

## When to use it

Use it for any regulated or multi-team Business Account. Each control covers a different part of account security:

| Control | What it gives you | Availability |
| --- | --- | --- |
| Audit log | Every change by user and time, ready to export | Every Business Account |
| Two-factor enforcement | A second factor for your team at sign-in | Proposed where your policy or plan calls for it |
| SSO for your Business Account | One sign-in through your identity provider across Android, iOS, and Business Account | Enterprise |

[Legal, privacy & security: questions and answers](https://begenuin.com/developers/get-started/any-business/legal-privacy-security-questions-and-answers) lists the full set of controls you can enforce.

## How it works

- The audit log records every change by user and time under **Settings** > **Audit**.
- It also records every Supervised Intelligence action with the approval or rule that allowed it. [Supervised Intelligence Autonomy and Approvals](https://begenuin.com/developers/browse-by-products/supervised-intelligence/supervised-intelligence-autonomy-and-approvals) sets what Supervised Intelligence can do without asking.
- Changes to agreements and billing are in the log too. Only the Owner role can sign agreements and change billing.
- Two-factor is proposed as required when your team is invited, where your policy or plan calls for it. The retailer playbook requires it.
- **Settings** > **Setup Single Sign On (SSO)** configures one SSO for unified login across Android, iOS, and Business Account, on Enterprise. Once it's set up, your brand's web app shows an extra SSO button at login. The sign-in flow is covered in [Set up single sign-on with your identity provider](https://begenuin.com/developers/developer-resources/guides/log-in-seamlessly-across-your-brand-ecosystem-using-sso).
- Other account controls sit alongside these: API keys per environment with rotation and a 24-hour grace period, domain and app allow-lists, and signed webhooks.
- Your team signs in to your Business Account with an email and password, or with a Google account. **Forgot Password** on the login screen emails a reset link.
- A new password needs a capital letter, a number, and a special character, within the minimum and maximum length.
- Roles apply at sign-in. Business Account shows each person only the modules their role allows.
- Moderation keeps its own record. The **History** sub-tabs in **Moderate** > **Content Moderation** and **Moderate** > **User Requests** show who reviewed each item and what they decided.

## Set it up

Octo proposes the controls with these steps already done. You review the result and confirm it.

1. Turn on two-factor under **Settings** > **Security**. Learn how in [Invite your team and assign roles](https://begenuin.com/developers/get-started/any-business/invite-team-assign-roles).
2. Configure SSO in **Settings** > **Setup Single Sign On (SSO)** on an Enterprise plan. [Plans explained: Free, Self-serve, and Enterprise](https://begenuin.com/developers/get-started/any-business/plans-explained) compares the plans.
3. Export the audit log.

## Settings

| Setting | What it controls |
| --- | --- |
| Enforcement | Whether your team must use two-factor authentication |
| SSO provider | The identity provider for one sign-in across Android, iOS, and Business Account, on Enterprise |
| Export schedule | When the audit log is exported |

Change enforcement under **Settings** > **Security**, and SSO under **Settings** > **Setup Single Sign On (SSO)**. The two-factor requirement for one teammate is part of [Business Account Roles and Scoped Roles](https://begenuin.com/developers/browse-by-products/control/business-account-roles-and-scoped-roles).

### Fill in the SSO form

- **OIDC Discovery**, set to **Yes** or **No**, changes which fields the form shows.
- You can show or hide the **Client Secret** while you enter it.
- Additional parameters go in as tags. You can add and delete user-info mapping rows.
- An empty mandatory field, including a user-info mapping value, shows a required error.
- **Save** turns on once you change something.

## What it reports

The audit log lives under **Settings** > **Audit**, and its export goes out on your schedule. [Security, data residency, and compliance](https://begenuin.com/developers/get-started/any-business/security-data-residency-and-compliance) explains what the log covers.

- **Audit log export**: every change, recorded by user and time.
- **Supervised Intelligence actions**: each action with the approval or standing rule that allowed it.

## Connect your systems

These controls run in your Business Account and need no code. Four live pages cover the server access around them. [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api) exchanges your API key and secret for the token every other call needs. [Environments, credentials, and test data](https://begenuin.com/developers/developer-resources/guides/environments-credentials-and-test-data) explains the separate QA and Production credentials. [Add moderators to a community](https://begenuin.com/developers/developer-resources/api/assign-moderators-to-community-using-api) gives accounts the moderator role from your own systems. [Update a group and its members](https://begenuin.com/developers/developer-resources/api/add-or-manage-group-members-collaborators-using-api) adds or removes group members and changes group settings.

The security and audit calls in the [Business Account API](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map) are proposed, not live. [Live API today and the Business Account API roadmap](https://begenuin.com/developers/developer-resources/guides/live-api-today-and-the-business-account-api-roadmap) maps what you can call now to what's planned.