Organization Policies

From the Organizations list, select your organization. In the sidebar, under Settings, click Policies.

Overview

Organization policies apply to every user in your organization. Every member can see them; only organization admins can change them.

Each policy is a dropdown or field whose first choice is No policy, which leaves the default described below. Pick a value and click Save policy.

A platform policy takes precedence whenever a platform admin has set it, to any value. The control is then disabled for your organization, and its tooltip says the policy is configured at the platform level.

Every change is recorded as an event in your organization's audit log.

Summary

Policy	Default (no policy)
No Root Access	Root access allowed
Nitro Instance Types Only	All AWS instance types allowed
No Public IP Addresses	Public IP addresses allowed
Archive Cost Data	Cost data is not archived
Event Retention	Events kept forever
Maximum API Key TTL	API keys 730 days, SCIM tokens no limit
Enforce MFA	MFA required
Enforce Security Key MFA	Any MFA method
Disable Password Login	Password login allowed
Disable Device Code Sign-in	Device code sign-in allowed
Allow Public Sessions	Public sessions not allowed
Allow Organization Session Sharing	Sharing allowed
Flexible Allocation System	Legacy allocation system
Allocation Start Date	Fiscal years start October 1
Default Billing Username	None
Workspace SSH Key Type	ECDSA P-256

Compute

No Root Access

Disable root access to cloud clusters and instances for all users in your organization, including resource owners. Owners can still sign in, but without sudo or administrator rights. Choose Enable root access or Disable root access. Defaults to Enable root access.

Nitro Instance Types Only

Restrict cloud clusters and instances to AWS Nitro instance types. Choose Allow all AWS instance types or Allow AWS Nitro instance types only. Defaults to allowing all instance types.

No Public IP Addresses

Prevent users in your organization from provisioning standalone public IP addresses. When enabled, requests to provision one are rejected. Choose Allow public IP addresses or Disable public IP addresses. Defaults to allowing them.

Data retention

Archive Cost Data

Summarize and then archive cost data after 1, 3, 6, or 12 months to keep reports fast. Nothing is deleted; older data is kept as a summary. This applies to legacy cost data only; costs attributed to allocations under the flexible allocation system are not archived. Defaults to no archiving.

Event Retention

Delete your organization's audit events older than 15, 30, 60, 90, 120, 180, or 365 days. Shortening the retention on a large history deletes the older events shortly after you save. When no policy is set, events are kept forever.

Maximum API Key TTL

Cap how many days an API key or SCIM token can be valid: 1, 2, 7, 14, 30, 90, 180, or 365 days, or Unlimited. Every new key needs an expiration within the cap. When no policy is set, API keys are limited to 730 days and SCIM tokens have no limit. Only Unlimited allows API keys that never expire.

Enforce MFA

Require users in your organization to complete multi-factor authentication when signing in with a password. Choose Require multi-factor authentication or Do not require multi-factor authentication. MFA is required by default.

Only platform admins see and change this policy, and it has no No policy option: it can be changed but not removed.

Enforce Security Key MFA

Require users in your organization to set up and use a hardware security key, such as a YubiKey, for multi-factor authentication when signing in with a password. Users without a registered key are asked to register one before they can continue.

Require hardware security key: any hardware security key.
Require FIPS-certified YubiKey: a FIPS 140-3 certified YubiKey (YubiKey 5 FIPS Series, firmware 5.7 or later), verified through device attestation.

Users signing in through an OpenID Connect provider with Skip Platform MFA Verification enabled are not affected; their identity provider is trusted to perform MFA.

Prevent users in your organization from signing in with a username and password. They must use another authentication method, and password resets are turned off. You can only enable this policy when your organization has at least one other authentication method configured.

Stop users in your organization from signing in to the pw CLI with a code they approve in a browser, a flow phishing can abuse. pw auth --device and code sign-in over SSH are refused. Signing in through a browser on the same computer, and API keys, still work. Device code sign-in is allowed when no policy is set.

Sessions

Allow Public Sessions

Let users in your organization make a session reachable by anyone with the link, without signing in. Public sessions are not allowed unless this policy allows them. Clearing the policy turns off any session that is currently public.

Let users share a session with everyone in your organization. Allowed unless this policy is set to Disallow sharing, which also unshares every session currently shared with the organization. Sharing with specific groups is not affected.

Billing

Flexible Allocation System

Choose how your organization budgets cloud spend:

Legacy allocation system (also the behavior when No policy (legacy) is selected): each group has an allocation total, and resources bill the Billing Group picked on them.
Flexible allocation system: budgets are allocations, and each resource belongs to a resource group that bills one allocation.

The change takes effect immediately. Read Flexible Allocation System before switching.

Allocation Start Date

The first day of your organization's fiscal year, chosen as a month and day. It names the fiscal years used to view budgets by year and to pick a time range in Reports. For example, with October 1 set, FY27 runs from October 1, 2026 through September 30, 2027. When no policy is set, fiscal years start on October 1. February 29 is treated as February 28 in non-leap years.

Allocations created before allocation periods were available also reset on this date: their Used and Estimated amounts, and the thresholds that act on them, only count spend since its most recent occurrence (at 00:00 UTC). Newer allocations count all of their spend, or the spend in their current period. To budget by year, give an allocation a period for each year.

This policy does not limit the date ranges you can pick on the cost dashboard or in Reports.

Default Billing Username

The username shown on dashboards and reports for cost records that have no user, such as shared account charges, support, taxes, and untagged resources. It must be at least 3 characters. Because it's applied when reports are read, changing it relabels past records too.

These three billing settings are also shown, read-only, under Cloud > Accounts > Billing Management and on each cloud account's billing page.

Workspaces

Workspace SSH Key Type

The type of SSH key generated for each member's workspace: ECDSA P-256 (default), RSA 4096, RSA 3072, or Ed25519. Existing keys change type at their next rotation. When no policy is set, ECDSA P-256 is used.

Navigation