Security settings

Security settings control how people sign in to your tenant — two-factor authentication, single sign-on with your identity provider, and how sign-on groups line up with access inside LendAPI. Use this page when you need to raise the bar on login verification or connect your organization’s identity provider instead of relying on individual passwords.

---

What’s on this page

The Security tab sits alongside Profile, Workspace, Configuration, Users, API, and Webhook in your tenant settings. Within Security, you’ll find three areas:

• Two-Factor Authentication — a section for requiring a second verification step at login.
• Single Sign-On (SSO) — a section for connecting your identity provider, with a banner that surfaces the current SSO status.
• Group Mapping — a section for aligning groups from your identity provider with structures inside your tenant.

The exact fields inside each section depend on your identity provider and plan. This page describes what each section is for; treat field-level labels as subject to change based on your setup.

---

Two-Factor Authentication

This section is where you turn on two-factor authentication for your tenant. Use it when you want a second verification step beyond a password before someone can access LendAPI.

---

Single Sign-On

This section is where you connect LendAPI to your organization’s identity provider. A status banner at the top of the section shows whether single sign-on is currently active for your tenant, so administrators can see the current state before making changes.

---

Group Mapping

This section lets you align groups defined in your identity provider with your tenant’s structure in LendAPI. It appears alongside the Single Sign-On section, so you typically configure it after connecting your identity provider.

---

Worked example

Meridian Credit Union runs its loan operations team through LendAPI and wants tighter login controls before its next compliance audit.

1. The tenant administrator opens Tenant Settings > Security.
2. In the Two-Factor Authentication section, the administrator turns on two-factor authentication so every user needs a second verification step at login, not just a password.
3. In the Single Sign-On section, the administrator connects Meridian’s identity provider. The status banner updates to reflect that single sign-on is now active for the tenant.
4. In the Group Mapping section, the administrator maps the “Underwriters” group from the identity provider so that underwriting staff line up correctly with their access in LendAPI.

The result: Meridian’s staff sign in through the credit union’s own identity provider, with two-factor authentication enforced, and their identity-provider group membership carried through into LendAPI.

---

Use case

A regional bank’s IT department requires that all vendor platforms, including LendAPI, authenticate through the bank’s central identity provider rather than separate passwords. The bank’s LendAPI administrator uses the Single Sign-On section to connect the identity provider, checks the status banner to confirm the connection is active, and uses Group Mapping so that staff already sorted into groups in the identity provider (loan officers, underwriters, compliance) don’t need to be re-sorted manually inside LendAPI.

---

Best practices

• Turn on two-factor authentication before connecting single sign-on, so login security doesn’t have a gap during setup.
• Check the single sign-on status banner after making changes to confirm the connection is active before telling staff to switch over.
• Set up group mapping after single sign-on is connected, so the groups you’re mapping already exist and are visible.
• Don’t assume field-level SSO configuration is identical across identity providers — confirm requirements with your provider before you start.

---

Steps: opening security settings

1. Go to Tenant Settings.
2. Select the Security tab.
3. Choose the section you need — Two-Factor Authentication, Single Sign-On, or Group Mapping.
4. Make your changes and save.

---

Unclear or not covered here

The following are not confirmed by available product documentation and are left out rather than guessed:

• Which identity providers are supported for single sign-on.
• What happens to existing sessions when two-factor authentication is turned on or off.
• Whether two-factor authentication can be required for some users and not others, or is tenant-wide only.
• What group mapping actually assigns groups to (roles, teams, or permissions) and what happens if a group has no mapping.
• Whether password policy, session timeout, IP restrictions, or audit logging exist as separate settings on this page. Earlier versions of this page referenced these; they are not confirmed by current source and have been removed pending verification.