People sign in to Amplify with their email address and a password, with single sign-on through your organization's identity provider, or both. Two-factor authentication can add a code from an authenticator app to password sign-in. All three are set up on the Authentication page, under Administration.
This article covers both the Advanced and Simple Models, and needs administrator access, or an admin role with access to Authentication — see Admin Roles.
Ways to sign in
- Password — users sign in with their email address and a password, which follows your password policy. See Password policy.
- Two-factor authentication — users who sign in with a password also enter a code from an authenticator app. See Two-Factor Authentication.
- Single sign-on — users sign in through your organization's identity provider, using SAML. See Single Sign-On.
Where single sign-on is turned on, the password policy and two-factor authentication only apply to users who can still sign in with a password.
The Authentication page
Navigate to Administration > Authentication. The page has a section for each part of sign-in:
- Password Policy Settings — how new users get their password, and what a password must contain. See Password policy.
- Two-Factor Authentication — whether every user must use two-factor authentication. See Two-Factor Authentication.
- Single Sign-On (SAML) — your identity provider, and how users are created when they sign in through it. See Single Sign-On.
- AI Assistant (MCP) OAuth — shown where MCP access is turned on, for connecting AI assistants to Amplify. See MCP Overview.
Each section is saved on its own, with its own update button.
Password policy
The password policy sets how new users get their first password, and the rules every password must follow.
New users' passwords
Distribution of new User Passwords sets how a new user gets their first password:
- admin — the administrator sets the password when they create the user.
- email — the new user is emailed an automatically generated password.
- token — the new user is emailed instructions to set their own password.
Password rules
- Password Complexity — the kinds of character every password must contain: Uppercase, Lowercase, Number, and Symbol.
- Minimum length — the fewest characters a password can have.
Changing the password policy
To change the password policy:
- Navigate to Administration > Authentication.
- Under Password Policy Settings, choose the Distribution of new User Passwords.
- Check each kind of character passwords must contain.
- Enter the Minimum length.
- Click Update Password Settings.
The rules apply the next time each user sets a password.
For managing users and their passwords, see Managing Users.