Set device and behavior policies
Turn on desktop protections for everyone, pause sessions that open too many secrets, limit showing passwords, and allow access only from trusted countries or the desktop app.
Steps
Open Admin console › Security › Policies › Devices & behavior.
Desktop security baseline: choose what the desktop app enforces — clipboard shield, hiding passwords while sharing (or also blocking copying), sticky-note warnings, link and download checks, open Wi-Fi warnings.
Behavior guard: set how many secrets may be opened or copied within a few minutes. Above that, admins get a high alert and the member can be asked to sign in again, or be paused until an admin lifts it in Alerts › Paused members. Owners are never paused.
Showing secrets: let people copy but not show passwords, or not show them while their screen is shared. You can also ask for a short reason, which is recorded in the audit log.
Trusted locations and devices: list the countries vault access is allowed from (checked by the server on every request) and optionally require the desktop app.
Good to know
- Try new policies with a pilot team first using a department or team override in Directory.