In the Security page of the admin panel, the account owner and account admins can customize your Lucid security settings to match the needs of your organization.

Free	Individual	Team	Enterprise	FedRAMP

See our Upgrade your Lucid account article for instructions to upgrade.

Access the Security page

To get to the Security page, follow these steps:

Select Admin.
Click Security in the left-hand menu.

Enable Domain Control

Domain Control is an Enterprise only feature that allows you to control the security settings for users on your domain and set security standards for your entire organization. With domain control enabled on your Lucid account, users are prevented from creating unauthorized accounts with the controlled domain.

When you enable domain control, users who attempt to sign up for a Lucid account will be notified that an Enterprise account already exists and will be redirected to verify their identity. Once they verify their identity, they’ll be added to your organization’s Lucid account.

The method you select to verify users' identities should match the default user sign in authentication method set for the account.

Select one of the following options for verifying user identity:

Confirmation email: The user receives an email with a confirmation link.
SAML authentication: The user is redirected to your organization’s SAML instance.
Google SSO authentication: The user is redirected to authenticate via Google SSO.
Office 365 SSO authentication: The user is redirected to authenticate via their Office 365 credentials.
Redirect to custom authentication URL: The user is redirected to a different SSO provider via an authentication URL.

Note: Due to the security demands of domain control, you will need to contact your Account Manager, Customer Success Manager, or contact sales to request set up.

Domain verification

Domains are verified for two purposes—consolidations and domain control.

Domain verification is a process that confirms ownership of specific domains prior to locking down a domain to be controlled by a single account or consolidating users who are on those domains. For security and data privacy reasons, Lucid is obligated to follow a specific procedure to verify that an account who's asking to consolidate or control a specific domain does own that domain.

Domain verification must occur if both of the following are true:

The domain to be consolidated or controlled is different from the account owner's domain (referring to their email address on the account).
There are no users on the account with the same domain as the one to be consolidated or controlled.

Domain verification methods

Lucid offers three ways to verify your domain:

Hosting Validation
DNS Record Validation
Email Validation

To request a domain verification for your Enterprise account, contact your Account Manager, Customer Success Manager, or contact sales and provide the following details:

The domain(s) to be verified.
Email address(es) and name(s) of the web-administrators of those domains (if verifying domain via Hosting or DNS Record Validation).
Email address(es) and name(s) of the Lucid admin(s).

Domain invites

Determine whether users on your Team or Enterprise account on the same domain can email you a request to join your account when they create a Lucid account. If you uncheck this box, you will no longer receive join requests and the next largest account with the same domain will receive the requests.

Determine whether users on your account can leave by accepting an invitation to another account. Allowing users to leave your account without express action from an admin is defaulted to off. Selecting that option will allow your users to accept explicit invites from other accounts.

Note: If a user leaves your account via an invitation, they will by default take their documents with them. However, if their documents are organized within a team folder, the documents will not be transferred with the user.

Allow non-admins to invite new users

With this setting, you can indicate the ability for non-admin users on your Team or Enterprise account to invite new users to join.

Your options include:

No restrictions. All users can invite new users.
All users can invite other users with the same—or approved—domains.
All users can invite new users from domains listed here.
Total lockdown. Only the account owner and account admins can invite new users.

Authentication sign-on methods

Select Authentication from the Security dropdown in the left-hand menu to access user sign-on and password settings.

The sign-on methods currently supported in Lucid are as follows:

Email and password
Google SSO
Office 365 SSO
Slack
SAML (Enterprise only)

Note: Lucid users can set up multi-factor authentication (MFA) via SSO login with Google or Microsoft. Enterprise accounts can set up multi-factor authentication via an Identity Management Provider (IDP).

Default authentication

Your account’s default authentication method is the login method users will encounter when they click Next or hit the "Enter" key after typing their email address into the Lucid login page.

The default authentication method selected should match the method selected to verify users identity (please see domain control section).

SAML

If you’re using SAML sign-on, SAML should be set as the default authentication method. If it’s not, users will be able to access Lucidchart, Lucidspark, and Lucidscale via your IDP, but will not be able to use SAML sign-on via the Lucid log in page.

Two-factor authentication (2FA)

Two-factor authentication—often shortened to 2FA or MFA—is a security process that requires users to verify their identity using two different methods. Typically those methods are something they know (like a password) and something they have (like a phone or security token).

In Lucid, admin have the option to enforce two-factor authentication under the “User sign-in” section of the admin panel. To require users on your account who log in with email and password to set up two-factor authentication through a third-party authentication app, follow these steps:

Check the box next to "Enforce two-factor authentication".
Select Continue.
Click Save changes in the top-right corner of the page.

Set up two-factor authentication as a user
If this option is enabled, all current users and all new users added to your account in the future will be prompted to set up two-factor authentication upon log in via email and password. To do this, users need to:

Log in to Lucid using your email and password.
On a separate device, download or open a third-party authentication app.
- You can use any authenticator app such as Google Authenticator, Microsoft Authenticator, LastPass and more.
Follow setup prompts within your authentication app.
Scan the Lucid-provided QR code from the app.
- Alternatively, click the eye icon under the QR code and type the Lucid-provided secret code that is revealed into the authenticator app.
Enter the 6-digit code generated by the authenticator app into the provided text box in Lucid.
Click Verify code.
Copy the recovery code that appears and paste it somewhere safe. This code will be needed if you need to sign in without your authenticator app or if you need to recover your account.
Check the box next to “I saved this code in a safe place”.
Click Complete.

Following this setup, users will be prompted to enter a 6-digit code from the authenticator app each time they log in with email and password.

Reset users’ two-factor authentication
At any time, account owners and account admins can reset one or more users’ two-factor authentication through the Users page of the admin panel. To do this:

Click Users from the navigation menu on the left-hand side of the admin panel.
Select one or more users from the list.
Click the three-dot menu to the far right-hand side of a selected user’s row.
Select Reset User 2FA.
Click Confirm.

The next time the selected users log in, they will be required to go through the two-factor authentication process, even if they have already done so in the past.

Restrict user log in to allowed IP addresses

If you, as an account owner or account admin, want your employees to only be able to log into their Lucid account from specific locations, check this box and list certain IP addresses by typing them into the field below. This feature requires CIDR notation to denote IP ranges, e.g. 192.168.2.0/24. For an overview of this and our other Enterprise Shield add-on features, check out this article.

Note: This feature will not prevent users from logging in with an allowed IP address and then moving to another address that is not listed.

Configure idle session time-out limit

With this feature, the account owner and account admins can set a time limit for inactivity before users are automatically signed out of the Enterprise account. If a user is idle for the set time limit, they will be required to log in again when they resume activity.

For more information on the Enterprise Shield add-on, check out our Enterprise Shield add-on overview article.

Note: This feature is available to all accounts on the FedRAMP environment, even those that don’t have the Enterprise Shield add-on.

The minimum limit you can set is 15 minutes and the maximum limit is 14 days.

To set a time-out limit, follow these steps:

Click "Security" from the menu to the left of the Lucid admin panel.
Select Authentication.
Scroll to the "Idle session time-out" section.
Check the box to “Automatically log out inactive users”.
From the dropdown menus, indicate the time limit.
Click Save changes in the upper-right corner.

If you do not want to enforce an idle session timeout limit, uncheck the box next to “Automatically log out inactive users”.

Set a password policy

If your organization allows email and password log in, the account owner and account admins can change the settings in Authentication from the dropdown under Security in the left-menu to increase the security of your users’ passwords.

On Team and Enterprise accounts, this includes setting a minimum number of characters, as well as specifying whether at least one of each of the following items are requested: upper case character, numeric character, symbolic character.

password-restrictions-if-email-and-password-allowed-for-Lucid-sign-in.png

Additional password restrictions available to Enterprise accounts only include setting a limit to failed login attempts allowed before lockout, along with the lockout duration period, requiring users to change their passwords after a certain amount of time, and preventing reuse of previously used passwords.

password-restrictions-available-on-enterprise-account.png

Force password reset

By selecting Force Password Reset you can force a password reset for every member of your organization. When a user logs in after you do this, they will be prompted to change their password.

Adjust sharing settings

The account owner and account admins can adjust the sharing settings by selecting Sharing from the Security dropdown in the left-hand menu. Across the top of the page you will see a tab for Sharing settings, Document ownership transfer, and Editor experience.

Basic sharing

Document and folder sharing
If you want to grant your Team or Enterprise users the ability to share documents, images, and folders with all users on the account at once, check this box.

check-box-to-enable-or-disable-sharing-across-your-lucid-account.png

Note: The document and folder sharing setting must be enabled in order to share corporate templates with the entire account. For additional details, refer to our Create and organize corporate templates article.

Document invitation previews
If you want document invitations that users on your account send out to include a preview of the document, check this box.

check-box-to-enable-or-disable-document-invitation-previews.png

Image sharing
You can select the option to restrict Lucidchart users to share specific images or opt to have all images shared automatically.

image-sharing-options-for-lucid-team-or-enterprise-account.png

Advanced sharing

Shareable link

This setting gives you control over whether users on your account can create shareable links to the Lucidchart documents, Lucidspark boards, and Lucidscale models on your account.

Public: Grant users the ability to generate a share link that is accessible to any user.
Restricted: Grant users the ability to generate a share link that will only be accessible for other users on the account.
Off: Disable ability for users to generate shareable links.

Customize shareable link settings at organizational group level

Using Lucid’s organizational groups, the account owner and account admins can customize shareable link settings for different users within your organization. To do so, select a group from the left-hand “Organizational groups” navigation menu before adjusting the shareable link settings. For more information on the Enterprise Shield add-on, check out our Enterprise Shield add-on overview article.

If you customize the shareable link settings for a particular organizational group in a way that is different from the parent group’s settings, a “Customized” tag will appear as shown in the image below.

advanced-sharing-showing-customized-tag-for-organizational-group-settings-in-admin-panel.png

The shareable link settings will be enforced on all documents and folders owned by individuals in that organizational group.

Note: If you put a document or folder into a folder owned by a user from a different organizational group, the parent folder’s sharing permissions take precedence over the permission of the document or folder inside it.

Expiring share links

To set a default expiration for all newly created share links, check the box and select a time frame for all links to expire. Users will be able to set a shorter time frame for expiration in an individual document or board, but will not be able to set an expiration for longer than the default you set here.

Keep in mind:

A default expiration applies only to share links created after the setting is enabled.
The default expiration setting applies to share links only. This means all collaborators who accessed the document prior to the link expiring will continue to have access to the document. To revoke access from a collaborator, you will need to unshare the document or board with them.

check-box-to-set-parameters-for-expiring-share-links.png

Guest Collaborator access in Lucidspark

Enable or disable the generation of Guest Collaborator access links for Lucidspark boards. To learn more, see our Guest Collaborators in Lucid article.

check-box-to-enable-or-disable-guest-collaborator-link-creation.png

Enable Join ID

Enable or disable the generation of a six digit Join ID code for your Lucidchart documents, Lucidspark boards, and Lucidscale models.

Sharing permissions for Join ID links:

Public with Guest Collaborators (Lucidspark only): If your account has shareable links set to Public and has Guest Collaborator access links enabled, using Join ID will grant Guest Collaborator access to recipients. If your account has shareable links set to Public and has Guest Collaborator access links disabled, using Join ID will grant Public - Edit and Share access to recipients.
Public: If your account has shareable links set to Public, using Join ID will grant Public - Edit and Share access to recipients.
Restricted: If your account has shareable links set to Restricted, using Join ID will grant Restricted to Account - Edit and Share access to recipients.
Off: If your account has shareable links set to Off, Join ID will not work and will instead display an error message.

Sharing via email

When setting the Sharing via Email preferences for your account, you have the following options:

Do not restrict sharing of items via email: users will be able to share documents through email to users on any domain.
Warn users who share documents to emails outside given domains: a warning message will be sent to a user whenever they attempt to share a document outside the allowed domains.
Restrict to following domains when sharing an item via email: users will only be able to share documents with other users on allowed domains. If a user attempts to share outside of those listed they will get a notification saying that they are not allowed to do so.

Note: If you have opted to warn or restrict users based on shared-to domains, you will be able to input permitted domains that you would like to allow in the text box at the bottom of the “Domain Restrictions” section. If you don’t do this, everyone on your account will be warned or restricted every time they attempt to share a document.

Publishing and embedding

These setting provide the following options:

Control whether users on your account can publish and publicly embed documents to web pages.
Allow embedded documents to persist in external apps even if the user that added the embedded document in the external app no longer has edit and share access to the Lucid document.

Transfer document ownership settings

This setting allows you to restrict who document ownership can be transferred to. You can opt to remove all restrictions, set it so that document ownership can only be transferred among those on your Enterprise account, or set it so that document ownership cannot be transferred. To see the steps to transfer document ownership, see this article.

Editor experience

In this section of the admin panel, you can enable or disable the ability for users to Chat in Lucidspark, search and use images and icons, and use the standard Lucidchart template library. This is also where you can upload any brand fonts you want to make available to the users on your account.

Chat

To enable the ability for users to chat while editing a board, check this box. Chat functionality is available in Lucidspark only.

Image and icon search

These settings allow you to control the following functionality:

Enable Bing image search to allow users to search for images.
Enable Giphy image search to allow users to search for GIFs.
Enable Icon Finder search to allow users to search for icons.

image-and-icon-search-settings-including-bing-giphy-and-icon-finder.png

Standard templates

Check this box to enable users to use standard Lucidchart templates. Unchecking this box will restrict users to only custom made templates, created either by you personally or by other users on your Team or Enterprise account.

enable-or-disable-standard-template-usage-for-Lucid-account.png

Brand fonts

Account admin can upload brand fonts that can be used by all users on your account in Lucidchart and Lucidspark. Here’s how:

Expand the Security dropdown in the left-hand menu of the admin panel.
Click Sharing from the breakdown of left-hand menu options.
Select the Editor experience tab at the top of the page.
Under “Brand fonts”, click the + sign to upload a font file.
Follow the prompts to upload the file.

add-brand-fonts-to-Lucid-account-for-access-across-all-documents.png

Lucid Key Management Service (KMS)

Lucid's Key Management Service (KMS) allows businesses to control their own encryption keys for an additional layer of security. To learn more about this service, see the KMS whitepaper.

For more information on the Enterprise Shield add-on, check out our Enterprise Shield add-on overview article.

Note: As an account owner or account admin, you will see the KMS menu option in the Security dropdown in the left-hand menu. If you haven’t yet enabled KMS, contact support.

If there is evidence that the key has been compromised, you can rotate your Master Key from the KMS page in the Lucid admin panel. To do so:

Navigate to the KMS page in the Lucid admin panel.
Select Rotate key.

User feature controls

Developer controls

Restricting Developer controls is only available to Enterprise accounts. When you restrict access to Developer tools, users on your account cannot unlock Developer tools themselves through their Account Settings, but the account owner and account admins can still assign the role manually through the Users page of the Lucid admin panel.

To see the steps and learn more, read our Developer tools in Lucid article and check out the Admin Controls section of the Lucid Development Guide.

section-of-the-lucid-admin-panel-to-restrict-access-to-developer-tools.png

Collaborative AI

Lucid’s Collaborative AI allows users to brainstorm and build ideas with more creativity and innovation in less time. You can control whether or not to give users access to this feature by toggling “Enable Collaborative AI” on or off. Restricting access to Collaborative AI is available to Team and Enterprise accounts.

For more information, check out our Transform productivity and innovation with Collaborative AI article.

Team hub access

With Lucid’s team hub experience, account members on Enterprise accounts can organize themselves into teams for more efficient collaboration. You can control what degree of access users on your account have to this feature under “Team creation and management” as well as who can view and manage teams in the admin panel under “Team management for admins”.

Team folder setup

By default, all users on your Enterprise account can create team folders.

team-folder-creation-settings-for-admin-only-set-up.jpg

To restrict team folder creation capabilities to Enterprise account admins only, follow these steps:

Scroll down to the “Team Folder setup” section of the feature controls page.
Select “Allow only admins to create Team Folders”.
In the text box that appears, add relevant details for how users can request the creation of a team folder.
- For example, you may type an admin name, email, phone number, or weblink they can use for their request.
Click Save changes.

Generate a document support PIN

Generate a temporary support PIN that allows a Lucid support agent to view all documents on your Enterprise account. This option is only available to account owners, account admins, and document admins.

To generate the support PIN, follow these steps:

Scroll down to the Support access section.
Select the Support PIN tab at the top of the page.
Click Generate Support PIN.
In the pop up modal that appears, click Copy to the right of the PIN.
Click Done.

You can now share the support PIN you generated with a Lucid support agent in a ticket so that they can assist you in troubleshooting. The PIN you generated is a temporary PIN that will be active for seven days.

Follow the steps above again if you need to access the temporary PIN, see the time remaining before your PIN expires, generate a new PIN, or revoke access to an active PIN.

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles