Set the organization's policies

Who may post vacancies, whether roles are public, two-step sign-in, the Made with line and who decides timesheets.

In short

Policies are the organization's house rules. They cover who may post vacancies and whether its roles are listed publicly. They also cover whether members must use two-step sign-in, whether its public pages show the Made with line, and whether team leads decide timesheets.

Before you start

Who: "Change organization settings".
Plan: requiring two-step sign-in and hiding the Made with line are Business and Enterprise features. The other policies are on every plan.
First: to require two-step sign-in, turn it on for your own account first.

Steps

Open Settings › Policies.
Change the policies you need (see below). Each change saves itself a moment later, and "What this changes" lists what your changes do.

Result: the policies apply to everyone in the organization from then on.

Good to know

Who may post vacancies: Administrators only, anyone with the Post and manage vacancies permission (the default), or Every member.
Keep our roles off the public board: roles stay open by link but are not listed, have no public organization page and are not indexed. Turning it on unlists every listed role.
Require two-step sign-in: members need an authenticator app or a passkey to work in the organization, and are asked to turn it on in Settings › Sign-in & security. Their Personal Workspace keeps working. It is a Business and Enterprise feature, and your own account must have it first. A member who signs in through the organization's single sign-on with a second factor at the provider is let in without one of their own.
Hide "Made with {{brand}}" on our public pages: only on Business and Enterprise. See /help/organizations/made-with-line.
Leads approve timesheets: a team's lead or deputy sees and decides the timesheets of the people in the teams they lead, never their own. Each person can see who sees their time.
The joining switches are in /help/organizations/joining-rules.

If something goes wrong

Require two-step sign-in cannot be turned on: turn on two-step sign-in for your own account first, and check the plan includes it.
The policy shows as paused: the plan no longer includes it. It works again when the plan does.
A member cannot work in the organization: two-step sign-in is required and they have not set it up. They can do it in Settings › Sign-in & security.