Skip to main content


Policies are configurations of all the different parts of the IAM. For all parts we have a suitable default in the IAM. The default configuration can be overridden for each organization.


You can find these settings in the menu organization in the section polcies. Each policy can be overridden and reset to the default.

Password Complexity

With the password complexity policy you can define the requirements for a users password.

The following properties can be set:

  • Minimum Length
  • Has Uppercase
  • Has Lowercase
  • Has Number
  • Has Symbol

Password Complexity Policy

Login Policy

The Login Policy defines how the login process should look like and which authentication options a user has to authenticate.

Register allowedEnable self register possibility in the login ui
Username Password allowedPossibility to login with username and password
External IDP allowedPossibility to login with an external identity (e.g Google, Microsoft, Apple, etc)
Force MFAForce a user to register and use a multifactor authentication
PasswordlessChoose if passwordless login is allowed or not

Login Policy

Multifactors / Second Factors

In the multifactors section you can configure what kind of multifactors should be allowed. For passwordless to work, it's required to enable U2F (Universial Second Factor) with PIN. There is no other option at the moment. Multifactors:

  • U2F (Universal Second Factor) with PIN


  • OTP (One Time Password)
  • U2F (Universal Second Factor)

Second- and Multifactors

Identity Providers

You can configure all kinds of external identity providers for identity brokering, which support OIDC (OpenID Connect). Create a new identity provider configuration and enable it in the list afterwards.

For a detailed guide about how to configure a new identity provider for identity brokering have a look at our guide: Identity Brokering

Lockout Policy

Define when an account should be locked.

The following settings are available:

  • Maximum Password Attempts: When the user has reached the maximum password attempts the account will be locked

If an account is locked, the administrator has to unlock it in the ZITADEL console

Private Labeling / Branding

With private labeling you can brand and customize your login page and emails, that it matches your CI/CD. You can configure a light and a dark design.

Make sure you click the "Set preview as current configuration" button after you finish your configuration. Before this it will only be set as your preview configuration.

LogoUpload your logo for the light and the dark design.
ColorsYou can set four different colors to design your login page and email. (Background-, Primary-, Warn- and Font Color)
FontUpload your custom font
Hide Loginname suffixIf enabled, your loginname suffix (Domain) will not be shown in the login page
Disable WatermarkIf you disable the watermark you will not see the "Powered by ZITADEL" in the login page

Private Labeling

Privacy Policy and TOS

Each organization is able to configure its own privacy policy and terms of service. A link to the current policies can be provided. On register each user has to accept these policies.