Security

Signing in

Your user name is usually your email address. Depending on how your organization set up QBO, the sign-in page shows:

• a user name and password form, and/or
• one button per single sign-on provider, such as Google or Microsoft, or your company’s own identity provider.

With single sign-on you sign in with your company account, and QBO never sees your password. Your security administrator decides which options appear.

If your organization requires it, you’ll be asked to accept the license terms the first time you sign in.

Passwords

Passwords must meet your organization’s password policy. By default, that means at least six characters, with an uppercase letter, a lowercase letter, a digit, and a special character. Your organization may also block certain words, and you can’t reuse recent passwords.

If you forget your password, request a reset. QBO emails you a link that expires after a short time (30 minutes by default). Follow it to choose a new password.

Note

If your organization uses single sign-on only, password resets happen in your company’s identity provider, not in QBO.

Locked out?

After several failed sign-in attempts in a row (three by default), your account is locked. You’ll see a message asking you to contact your security administrator. Only an administrator can unlock it; waiting won’t help.

Your administrator can also deactivate accounts, and may restrict sign-in to approved IP addresses (for example, your office network). If you can sign in at work but not from home, an IP restriction is the likely reason.

Why can’t I see a record?

QBO checks two things:

1. Your roles. Roles decide what you can do: search processes, edit contacts, generate documents, approve a workflow step. If a button or panel is missing, your role may not include it.
2. Your organization’s access. If you work for a partner, such as a law firm, vendor, or agency, you see only the records your organization is assigned to, plus the records beneath them. When a process is assigned to your firm, you see the process and its tasks, documents, and messages. When it’s reassigned, that access moves with it.

Search results respect both rules. Two users running the same search can see different results, and that’s expected.

Being impersonated

To test security settings, an administrator may temporarily act as you (“impersonate” your account) to see exactly what you see. Each impersonation is recorded in the security log. Your administrator can turn impersonation off entirely, which is recommended for production systems.

Signing out

Use Sign out on the main menu. Shared or public computers should always be signed out.

For what the security log records and how roles and access are configured, see the Power user view.