Audit Log, Two-Factor, and SSO for BCC
Every change recorded by user and time, two-factor enforcement, and SSO for BCC on Enterprise.
These three controls decide how your team gets into Brand Control Center (BCC) and record what they do there. The audit log starts recording when your first invitations go out. Two-factor and SSO decide how your team signs in.
This capability arrives as a proposal when your network needs it, filled in from your brand context, and goes live when you confirm it. It's part of Controls, and Security, data residency, and compliance explains how these controls fit with Genuin's other security measures.
When to use it
Use it for any regulated or multi-team Business Account. Each control covers a different part of account security:
| Control | What it gives you | Availability |
|---|---|---|
| Audit log | Every change by user and time, ready to export | Every Business Account |
| Two-factor enforcement | A second factor for your team at sign-in | Proposed where your policy or plan calls for it |
| SSO for BCC | Team sign-in through your identity provider | Enterprise |
Legal, privacy & security: questions and answers lists the full set of controls you can enforce.
How it works
- The audit log records every change by user and time under Settings > Audit.
- It also records every Octo action with the approval or rule that allowed it. Octo Autonomy and Approvals sets what Octo can do without asking.
- Changes to agreements and billing are in the log too. Only the Owner role can sign agreements and change billing.
- Two-factor is proposed as required when your team is invited, where your policy or plan calls for it. The retailer playbook requires it.
- SSO for BCC signs your team in to Brand Control Center on Enterprise. Member sign-in to your community is a separate setup, covered in Set up single sign-on with your identity provider.
- Other account controls sit alongside these: API keys per environment with rotation and a 24-hour grace period, domain and app allow-lists, and signed webhooks.
Set it up
Octo proposes the controls with these steps already done. You review the result and confirm it.
- Turn on two-factor under Settings > Security. Learn how in Invite your team and assign roles.
- Configure SSO for BCC on an Enterprise plan. Plans explained: Free, Self-serve, and Enterprise compares the plans.
- Export the audit log.
Settings
| Setting | What it controls |
|---|---|
| Enforcement | Whether your team must use two-factor authentication |
| SSO provider | The identity provider your team uses to sign in to BCC, on Enterprise |
| Export schedule | When the audit log is exported |
Change enforcement and SSO under Settings > Security. The two-factor requirement for one teammate is part of Business Account Roles and Scoped Roles.
What it reports
The audit log lives under Settings > Audit, and its export goes out on your schedule. Security, data residency, and compliance explains what the log covers.
- Audit log export: every change, recorded by user and time.
- Octo actions: each action with the approval or standing rule that allowed it.
Connect your systems
These controls run in Brand Control Center and need no code. Four live pages cover the server access around them. Generate an access token exchanges your API key and secret for the token every other call needs. Environments, credentials, and test data explains the separate QA and Production credentials. Add moderators to a community gives accounts the moderator role from your own systems. Update a group and its members adds or removes group members and changes group settings.
The security and audit calls in the Business Account API are proposed, not live. Live API today and the Business Account API roadmap maps what you can call now to what's planned.
