Restricted administration

Admin sign in

Privileged roles continue with an app-owned authenticator check. Employee-only accounts are denied.