With device approval on, a member's new device can't open the team's vaults until it is approved: by an owner or admin, or by the member from one of their own devices the team already approved. A stolen master password is then not enough to read the team's vaults on someone else's machine.
On morphgate.com, device approval is part of the Business plan and the team trial.
Turn it on
Owners and admins turn it on in either place:
- In the app, in the team's Policies: tick the device approval option and choose Save policies.
- On the team page at morphgate.com, under Device approval: tick Require approval of new devices and choose Save device approval.
Turning it on approves every device that confirmed members are signed in on now, so nobody is locked out. Turning it off is always allowed.
On a new device
When you sign in on a new device, its request is filed by itself. The sidebar shows Waiting for approval and the team's name. Choose it to see who can approve the device, and Check again once someone has.
- Your personal vault syncs as usual. Only the team's vaults wait.
- If the device is denied, the sidebar says the team denied this device, and its vaults stay closed. Ask an owner or admin, or approve it yourself from another approved device.
- On morphgate.com, owners and admins with a verified address get an email when a device asks.
Approve or deny
In the app
Waiting devices show in the team's page under Waiting for approval, with the member, device name, platform and when it asked. The sidebar shows Teams · approve a device. Choose Approve or Deny.
- Owners and admins see and decide everyone's devices.
- Members see their own devices, and can approve them from another device the team already approved.
- A device can never approve itself. It says Approve it from another of your devices.
- Decisions are made from a device the team approved.
On the website
The team page lists waiting devices with Approve and Deny, for owners and admins. Your own devices can't be approved there; approve them from one of your devices.
An owner or admin whose only device is waiting isn't stuck: approve it from another approved device, or turn the policy off on the team page.
What counts as approved
- Devices signed in when the policy was turned on.
- A member's devices when an admin confirms the member.
- Devices someone approved.
Signing a device out of sync forgets its approvals, everywhere. After it signs in again, it needs approval again. A plain lock or restart doesn't. Removing a member deletes their approvals.
What it protects, and what it doesn't
Device approval decides whether the server hands a device the team's encrypted vaults. It doesn't change any keys. It doesn't take anything away from a device that already has the vaults; for that, remove the person or sign the device out, and rotate keys. See Removing members and rotating keys.
Requests, approvals and denials appear in the activity log.
If the team leaves Business
Device approval stays on, so devices stay protected. Admins can still approve and deny, and can turn it off, but can't turn it on again without Business.