> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Auto-Login Authentication

The Auto-Login Authentication method provides a token-based authentication link in the quarantine notification email. This token allows end-users to access their quarantined emails in the Self-Service Quarantine for a specified number of days.

## Permission

The Auto-Login Authentication method grants only the permissions associated with the **xcc\_quarantine\_user** role. It cannot retrieve or apply permissions from other user roles. For more details about the permissions associated with the xcc\_quarantine\_user role, refer to the [Users, Roles, and Permissions](/9.0/users-roles-and-permissions#roles) documentation page.

## Set-up Guide

1. Log in to the xorlab Security Platform with an admin account.
2. Click the **Admin** icon in the right menu.
3. In the **Admin Panel**, click **Expert Editor**.
4. Navigate to `/shared/guarded_tenants.yml`
5. Add the following configuration:

<Accordion title="Expand to read the instructions.">
  * Include the `autoLoginLink` block for each tenant.
  * Set `enabled` to `true` to include an auto-login link in all quarantine notification emails.
  * Set `enabled` to `false` to disable the feature.
  * `expirationDays` defines the validity period of the authentication link.
  * The default of `expirationDays` is 7 days.
  * To make links permanent, set `expirationDays` to `-1`.
</Accordion>

```shell theme={null}
autoLoginLink:
    enabled: true
    expirationDays: 7  
```

Example configuration:

```yaml title="Expert Editor: /shared/guarded_tenants.yml" theme={null}
---
tenants:
    - uid: 00000000-9999-0000-0000-000000000000
        name: example.com
        bccFallbackDomain: example.com
        domains:
        - example.com
        - example.ch
        - '**.example.com'
        
        autoLoginLink:
            enabled: true
            expirationDays: 7  
```

## Shared Mailboxes

Quarantine notification emails are sent to all users with access to a shared mailbox. Anyone who receives the notification email can use the auto-login link to access the Self-Service Quarantine.

## Compatibility with Authentication Methods

The Auto-Login Authentication method is compatible with other authentication methods, including SAML, LDAP, and password-based authentication. This allows organizations to provide seamless access to quarantined emails for end-users while preserving existing authentication mechanisms for roles with elevated permissions. No configuration changes are needed in /auth/auth/auth.yml to enable this feature.

When enabled, the auto-login token is included in all quarantine notification emails. It is not possible to restrict the Auto-Login Authentication method to specific user groups—once activated, all users receiving quarantine notifications will have access through the auto-login link.

## Access for Elevated Roles

When users with elevated roles—such as analysts or administrators—receive a quarantine notification for their own quarantined emails, they can use the auto-login link to access their Self-Service Quarantine. However, this authentication method does not grant access to the Analyst Dashboard, Admin settings, or other privileged areas of the platform.

To access these administrative features, users with elevated roles must first sign out and re-authenticate using their primary authentication method, such as SAML or LDAP. This ensures that privileged actions remain protected under stricter authentication controls, maintaining security while still allowing convenient access to quarantined emails.

## Multi-Tenancy Usage

The Auto-Login Authentication method is compatible with multi-tenancy environments and can be enabled separately for each tenant.

1. Log in to the xorlab Security Platform with an admin account.
2. Click the **Admin** icon in the right menu.
3. In the **Admin Panel**, click **Expert Editor**.
4. Navigate to `/shared/guarded_tenants.yml`
5. Add the following configuration to each tenant:

<Accordion title="Expand to read the instructions.">
  * Include the `autoLoginLink` block for each tenant.
  * Set `enabled` to `true` to include an auto-login link in all quarantine notification emails.
  * Set `enabled` to `false` to disable the feature.
  * `expirationDays` defines the validity period of the authentication link.
  * The default of `expirationDays` is 7 days.
  * To make links permanent, set `expirationDays` to `-1`.
</Accordion>

```shell theme={null}
autoLoginLink:
    enabled: true
    expirationDays: 7  
```

Example configuration:

```yaml title="Expert Editor: /shared/guarded_tenants.yml" theme={null}
---
tenants:
      - uid: 11111111-1111-1111-1111-111111111111
        authTenantId: tenantA
        bccFallbackDomain: tenantA.com
        domains:
          - tenantA.com
        
        autoLoginLink:
            enabled: true
            expirationDays: 7  

      - uid: 22222222-2222-2222-2222-222222222222
        authTenantId: tenantB
        bccFallbackDomain: tenantB.com
        domains:
          - tenantB.com
        
        autoLoginLink:
            enabled: true
            expirationDays: -1 
```