Professional and Enterprise add controls in Settings › People and access › Security and access › Policies. In Essentials they are shown with the plan upgrade offer.
Manual approval of handhelds
With Manual approval, each new handheld waits for an administrator to approve it on the Devices tab. Users with the «Manage security» permission receive an email for each request. In the meantime, the app shows «This device is waiting for approval» and signs in automatically once it is approved.
Two-step verification for all Administrative users
When enabled, each user with an Administrative license must set up two-step verification at their next sign-in.
Allowed networks (IP)
Restrict web access for Administrative users to your company's networks. Enter one address or network (CIDR) per line, IPv4 or IPv6. The list never applies to the app, to the Wizard or to Operator users. Chainlink does not allow you to save a list that excludes the network you are saving it from.
If the owner is outside the allowed networks, they can select Send a recovery link to my email on the sign-in screen: the link can be used once and expires in 15 minutes.
Shared-use alerts
The Alerts tab shows signs that two people share one user: activity from two devices within 5 minutes, more than 3 devices in one day, more than 5 session takeovers in one day, more than 14 consecutive hours of activity or frequent license reassignments. Alerts never block operations; users with «Manage security» receive an email and can mark them as reviewed.