Designing EspoCRM roles and teams
Structuring access in EspoCRM: all, team and own levels, team-inherited roles, baseline roles, sales manager versus rep examples and checking a user's effective access.
EspoCRM roles, security and access
Controlling access to EspoCRM: roles and teams, portal roles, user types including API users, two-factor authentication, password and session policy, IP allowlists and app secrets.
EspoCRM customer portal roles and access
Exposing the right data to portal users: portal roles, account and contact level access, tab lists, cases and knowledge base visibility and separate portals per audience.
EspoCRM API users and integration accounts
Setting up integrations safely in EspoCRM: API user type, role-scoped permissions, API key versus HMAC authentication and rotating credentials.
Enabling two-factor authentication in EspoCRM
Turning on 2FA in EspoCRM: TOTP, email and SMS methods, requiring 2FA for regular users, server time for TOTP and using the identity provider's MFA when OIDC is enabled.
EspoCRM password, recovery and session policy
Setting EspoCRM login policy: password strength, recovery link lifetimes, disabling admin recovery, no-exposure recovery, auth token idle time and lifetime.
Restricting EspoCRM access by IP address
Limiting EspoCRM logins to office or VPN addresses with the IP whitelist, the REMOTE_ADDR parameter behind proxies and exceptions for portals and API users.
Storing API keys in EspoCRM app secrets
Keeping credentials out of formula and workflows with EspoCRM App Secrets: creating secrets, reading them in formula and using them in Send HTTP Request headers.
Locking down EspoCRM upgrades and extension uploads
Reducing admin attack surface in EspoCRM 10: UI upgrades disabled by default, disabling extension upload, upgrading from the CLI in maintenance mode instead.
