Security and audit

Security and audit settings help admins protect access to the workspace and understand important activity after it happens.

Use this hub when you are setting up account protection, reviewing session behavior, creating API tokens, or checking audit history. These settings protect student profiles, Leads, applications, documents, user access, and workspace configuration.

What this guide helps configure

Before you start

Prepare these items before changing security or audit settings:

If you are still setting up access, start with users, roles, and permissions and scope.

Security Settings

Open /t/settings/security.

The page title is Security Settings. Use this page to review the security settings available in your workspace. When the changes are ready, select Save Security Settings.

Use a careful rhythm for this page:

1. Review the current settings before changing anything.
2. Change only the settings you meant to change.
3. Save the settings.
4. Test sign-in and access with a safe user account.
5. Record what changed and why.

Avoid making several access-related changes at the same time. If users have trouble signing in later, smaller changes are easier to review and correct.

Session Policy

Open /t/settings/security/sessions.

The page title is Session Policy. Use this page to review how signed-in sessions should work for users in the workspace.

Session policy matters because many study abroad teams use shared office computers, remote work, and multiple branch locations. A practical policy should balance convenience with protection for student profiles, applications, and documents.

After updating session policy, test with at least one admin user and one normal team user. Confirm that users can continue daily work and that the policy feels appropriate for your agency's operating style.

API Access

Open /t/settings/api-access.

The page title is API Access. Use this page when an approved system needs a token to connect with the workspace. Select Generate Token when you need to create a new token.

Treat tokens like passwords:

1. Generate tokens only for approved systems or trusted internal work.
2. Give each token a clear business purpose.
3. Share tokens only through a secure channel.
4. Remove or replace tokens that are no longer needed.
5. Review token access when a team member or vendor relationship changes.

Do not create a token just to avoid giving a person the correct user account or role. People should normally use their own Edmissa user account so access and activity stay clear.

Audit Logs

Open /t/settings/audit-logs.

The page title is Audit Logs. Use this page to review workspace activity. The page includes filters by date, user, action, and type. Select Export when you need a copy of the filtered results.

Audit logs help answer questions such as these examples:

Use exports for formal reviews, handovers, and issue investigations. Keep exports in a secure place because they may include sensitive workspace activity details.

Recommended first version for study abroad agencies

For a first setup, keep the model simple and easy to review:

1. Give each team member their own user account.
2. Keep admin access limited to trusted staff who manage configuration.
3. Use roles that match real jobs, such as counselor, manager, coordinator, reviewer, and admin.
4. Review security settings before inviting the full team.
5. Use a session policy that fits your office and remote-work habits.
6. Generate API tokens only for approved systems with a clear purpose.
7. Review audit logs after major access changes.
8. Export audit logs when you need a shared review file.

Start with a stricter setup, then expand access when the work clearly needs it. It is easier to grant more access later than to clean up broad access after people have started using it.

Safe change guidance

Use this checklist before saving a security, session, or API access change:

If a change causes an access problem, use Access and permissions troubleshooting to check account status, role assignment, permissions, scope, and location access.

Test after setup

After the first setup or any important change:

1. Sign in as an admin and confirm the settings pages open as expected.
2. Sign in as a normal team user and confirm restricted settings are hidden.
3. Open sample student profiles, Leads, applications, and documents that the user should be able to work with.
4. Confirm the same user cannot open work or settings outside their role.
5. Create or review one harmless activity, then confirm it appears in audit history.
6. Use the audit log filters by date, user, action, and type.
7. Export a filtered audit log if your agency needs a review file.

Test in more than one location if your agency works across multiple branches.

Related guides