> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Enable Auto-Login

> Passwordless quarantine access for employees, via a time-limited link embedded in notification mails.

The auto-login link grants end-users access to their quarantined emails in the SSQ, under the `xcc_quarantine_user` role, see [Roles](/latest/built-in-user-roles).

## Quickstart

The following steps will enable Auto-Login links:

1. In the Expert Editor, open `/shared/guarded_tenants.yml`.
2. Add the following configuration:

   <Accordion title="Expand to read the instructions.">
     * Include the `autoLoginLink` block for each tenant.
     * Set `enabled` to `true` to include an auto-login link in all quarantine notification emails.
     * Set `enabled` to `false` to disable the feature.
     * `expirationDays` defines the validity period of the authentication link.
     * The default of `expirationDays` is 7 days.
     * To make links permanent, set `expirationDays` to `-1`.
   </Accordion>

   ```yaml /shared/guarded_tenants.yml {7-9} theme={null}
   tenants:
     - name: example.com
       domains:
         - example.com

       autoLoginLink:
         enabled: true
         expirationDays: 7  
   ```
3. Click **Publish**. The Auto-Login configuration becomes active within about one minute.
4. Now all quarantine notifications will contain Auto-Login links.

## Create access link

For testing purposes, you can generate a link to access a specific mailbox in the SSQ.

Prerequisites:

* You need the `xcc_user_impersonate` permission, which is granted by the admin role
* `autoLoginLink` needs to be enabled, as shown above

Access this URL in your browser to get the token:

```
https://<your.xorlab.instance>/api/v2/autologin/v1/generateToken?mailbox=test@example.com
```

## Trigger a notification

You can trigger an artificial quarantine notification to a specific mailbox, helping users regain access to the SSQ:

Prerequisites:

* You need an active, signed-in xorlab administrator session in the same browser. This endpoint is not publicly accessible and cannot be called anonymously.
* `autoLoginLink` needs to be enabled, as shown above, for the notification to contain an access link.

```
https://<your.xorlab.instance>/api/v2/emailNotification/v1/sendQuarantineAccessNotification?mailbox=test@example.com
```

<Warning>
  **Use with care**

  The notification is delivered to whichever mailbox you specify, and depending on the tenant configuration it may contain a valid Auto-Login link for that mailbox. Only trigger it for mailboxes you are entitled to access.
</Warning>

## Additional information

### Compatibility with Authentication Methods

The Auto-Login Authentication method is compatible with other authentication methods, including SAML, LDAP, and password-based authentication. This allows organizations to provide seamless access to quarantined emails for end-users while preserving existing authentication mechanisms for roles with elevated permissions. No configuration changes are needed in /auth/auth/auth.yml to enable this feature.

When enabled, the auto-login token is included in all quarantine notification emails. It is not possible to restrict the Auto-Login Authentication method to specific user groups—once activated, all users receiving quarantine notifications will have access through the auto-login link.

### Access for Elevated Roles

When users with elevated roles—such as analysts or administrators—receive a quarantine notification for their own quarantined emails, they can use the auto-login link to access their Self-Service Quarantine. However, this authentication method does not grant access to the Analyst Dashboard, Admin settings, or other privileged areas of the platform.

To access these administrative features, users with elevated roles must first sign out and re-authenticate using their primary authentication method, such as SAML or LDAP. This ensures that privileged actions remain protected under stricter authentication controls, maintaining security while still allowing convenient access to quarantined emails.

## Multi-Tenancy

The `autoLoginLink` block shown above is configured per tenant, so in a multi-tenant deployment you can enable Auto-Login for some tenants and not for others, and give each tenant its own `expirationDays`.

Auto-Login is our recommended way to give the end-users of a tenant access to their SSQ, because it requires no integration with the tenant. See [Enable Tenant Login](/latest/multi-tenancy-authentication#auto-login) for a per-tenant example.