Security and data retention for a multiple-environment account are set in Production and apply to every non-production environment, so your environments stay consistent without separate configuration. This article is for account owners and administrators. It explains how single sign-on (SSO) and multifactor authentication (MFA) requirements and the data retention period cascade from Production to your other environments. For what environments are and the full list of settings that cascade, see Multiple environments overview.
Prerequisites: You must be an owner or administrator in Production to create or manage environments.
Single sign-on (SSO) and multifactor authentication (MFA)
The owner or an administrator enables SSO or MFA in Production first. After a requirement is enabled in Production, it's enabled in every non-production environment, and the administrators of a non-production environment can then adjust the security settings for that environment. For MFA, set the requirements in Production (for example, a 30-day device trust), and they cascade to users in every other environment. An environment can require either SSO or MFA, not both at the same time.
Data retention
The data retention period is set by the owner or an administrator in Production. After it's set there, it applies to every environment. See Retain your log and error data.
Legacy Production and Sandbox accounts
If your account hasn't upgraded to the multiple-environment structure, Production and Sandbox share the same underlying resources, and a change in one is immediately reflected in the other. See Multiple environments overview and Upgrade to the multiple-environment structure.