Configure console access, logon passwords, and multi-factor authentication (MFA) for RAM users.
Overview
Console logon settings control how a RAM user accesses the Alibaba Cloud console. These settings do not affect programmatic access through AccessKeys.
Available logon settings:
|
Parameter |
Description |
|
Console Access |
Controls whether the RAM user can log on to the Alibaba Cloud console. |
|
Set Logon Password |
Sets or resets the console logon password. |
|
Password Reset |
Requires the user to change their password at the next logon. |
|
Enable MFA |
Requires MFA during logon. |
If SSO is enabled for the RAM user, these logon settings do not take effect.
Enable console logon
Enable console access and set a password for the RAM user.
Console
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Users page, click the name of the RAM user.
-
On the Authentication tab, in the Login Profile section, click Enable Console Logon.
-
In the Enable Console Logon dialog box, configure the following parameters:
-
Console Access: Click Enabled to enable console logon.
-
Set Logon Password: Select Automatically Regenerate Default Password or Reset Custom Password.
-
Password Reset: Specify whether to require a password reset at the next logon. When setting an initial password, select Required at Next Logon to prevent password sharing.
-
Enable MFA: Specify whether to require MFA. If you select Required, the user is guided through MFA setup at next logon. Recommended.
-
-
Click OK.
API
Required permission: ram:CreateLoginProfile.
Call CreateLoginProfile to enable console logon and set an initial password.
View console logon settings
View a RAM user's console access status, password, and MFA settings.
Console
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Users page, click the name of the RAM user.
-
On the Authentication tab, in the Login Profile section, view the status of the following logon settings:
-
Console Access: Shows whether console access is enabled:
-
Unset: Console access has not been enabled.
-
Inactive: An administrator has disabled console access.
-
Active: An administrator has enabled console access.
-
-
Last Logined Time: Last successful console logon. Use this to audit idle accounts.
-
MFA Required: Shows whether the user must complete MFA when logging on.
NoteMFA is required during logon if any of the following conditions are met (in descending priority):
-
The Enforce for all users option is selected in the RAM global MFA policy (default). Configure this in Multi-factor authentication settings.
-
MFA is required in the individual logon settings for the RAM user.
-
The user has bound an MFA device (security phone number or virtual MFA device).
If none apply, the user is prompted to bind an MFA device at each logon but can skip.
-
-
Reset Password On Next Sign-in: Shows whether the user must reset their password at the next logon.
-
Password Status: Shows the current password status. Status values are defined in What are an initial password and its validity period?.
-
Initial Password Available: The initial password is valid. The user can log on with this password.
-
Initial Password Expired: The initial password has expired. The user cannot log on with this password.
-
Not Initial Password: Not an initial password. Expiration follows the password expiration policy only, not the initial password validity period.
-
-
Console Sign-in: The RAM user's console logon link. Available after console access is enabled.
-
API
Required permission: ram:GetLoginProfile.
Call GetLoginProfile to view a RAM user's console logon settings.
Modify console logon settings
Update a RAM user's access status, password, or MFA settings.
Console
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Users page, click the name of the RAM user.
-
On the Authentication tab, in the Login Profile section, click Modify Logon Settings.
-
In the Modify Logon Settings dialog box, modify the logon parameters.
-
Console Access: Click Disabled to disable console logon.
Important-
Disabling console access forces the RAM user and any assumed roles to log off.
-
Disabling console logon also prevents passkey-based logon.
-
-
Other settings are the same as in Enable console logon.
-
-
Click OK.
API
Required permission: ram:UpdateLoginProfile.
Call UpdateLoginProfile to modify a user's console logon settings.
Clear console logon settings
Permanently deletes a RAM user's console logon information, including the password.
-
Clearing console logon information is irreversible.
-
Clearing console logon settings forces the user and any assumed roles to log off.
Console
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Users page, click the name of the RAM user.
-
On the Authentication tab, in the Login Profile section, click Remove Logon Settings.
-
In the Remove Logon Settings confirmation dialog box, click OK.
API
Required permission: ram:DeleteLoginProfile.
Call DeleteLoginProfile to clear a user's console logon settings.
Clearing console logon settings does not affect passkeys, MFA bindings, or AccessKeys.
Security best practices
-
Enforce MFA: Enforce MFA for all console users — one of the most effective security measures.
-
Require initial password reset: Select Require password reset when setting initial passwords to prevent password sharing.
-
Separate console and API access: Disable console logon for accounts that only need API access (CI/CD, applications) to reduce the attack surface.
-
Audit accounts regularly: Check Last Logon Time and disable or remove idle accounts.
FAQ
What is the difference between disabling access and clearing settings?
Disabling is reversible and preserves the password and other logon settings. Clearing is irreversible and deletes all logon information.
Does disabling console logon affect AccessKey access?
No. Console logon and API access are independent. To prevent AccessKey usage, disable the AccessKey separately.
What happens to active sessions when passwords change or logon is disabled?
All active console and assumed-role sessions terminate immediately. The user must log on again.
Can a RAM user reset their own password?
RAM users cannot reset their own console logon passwords. A RAM administrator must reset the password. Modify the password for a user as a RAM administrator.
How do I find a user's last logon time?
Check the Last Login Time in the Login Information section on the Authentication tab.
Call GetLoginProfile via the API to obtain LastLoginTime.
-
Console: On the user details page, go to the Authentication tab. In the Login Profile section, view the user's Last Logon Time.
-
API: Call the GetLoginProfile API. The response includes the
LastLoginTimefield.
What is an initial password and its validity period?
To mitigate security risks associated with long-term unused RAM users, such as compromised passwords leading to resource threats, unexpected costs, or ransomware attacks, RAM introduces the "initial password" mechanism, effective from January 26, 2026. The system marks console logon passwords that meet specific criteria as an "initial password", which has a default validity period of 14 days. If a user does not successfully log on for the first time within this period, the password automatically expires and must be reset by an administrator (official announcement).
A password is an initial password if any of these conditions apply:
-
First-time creation: The first console logon password set for a RAM user, including both autogenerated and custom passwords.
-
Re-enablement: The password set for a user after their console logon settings have been cleared and then re-enabled.
-
Reset before first logon: If an administrator resets an initial password before the user logs on with it, the new password is still considered an initial password. The validity period is recalculated from the time of the reset.
Both the initial password validity period and the account's regular password validity period apply; the shorter period takes effect. Adjust the initial password validity period in the RAM global password policy. Keep it no longer than the regular password validity period.
How do I check the initial password status?
On the user details page, go to the Authentication tab and find the Login Profile section. Check the password status. If it shows Initial password expired, the user cannot log on and an administrator must reset the password.