Screens connect outbound only, players have no remote login and no open ports, and nobody signs in with a password. Security and access covers what Screenly does by default. This page is the part only you can do.
Sign-in
On Enterprise, use SAML single sign-on and set the multi-factor policy at your identity provider. That is one policy for every application, and Screenly follows it.
Without SSO, have people sign in with a passkey, which cannot be phished. Anyone who signs in with a one-time email code should turn on two-factor authentication, so a compromised mailbox alone is not enough to get in.
Roles
Give each person the lowest role that covers their work. User is enough for screens, content, playlists, and apps, which is what most people do. Keep Admin for the people who run the deployment, and make the Owner somebody who will stay with the organization. See Roles and permissions.
For contractors, agencies, and auditors, set an Active until date when you invite them. Their access then ends on that date whether or not anybody remembers to remove it. See Temporary access.
An API token carries the role of the person who created it. Make tokens for automation from an account with only the role the automation needs, and delete them when it is retired. See API tokens.
Workspaces as the access boundary
Roles do not decide who sees which screens. Every member of a workspace sees every screen, playlist, and piece of content in it.
If some people must not see some screens, those screens belong in a separate workspace. Five sites with ten screens each, where each site’s staff should only reach their own screens, is five workspaces, and each person is invited only to the ones they need. See What a workspace is.
Share playlists rather than access
To keep central material under one team’s control, put it in a workspace only that team belongs to and share the playlist with the site workspaces. They can schedule it on their screens but cannot change what is in it.
Shared playlists are an Enterprise feature, and sharing needs Admin or Owner rights in both workspaces. See Sharing between workspaces.
Network
Put players on a dedicated VLAN that only allows outbound connections: to the hosts in Hostnames and ports to allow, plus any internal services the screens display. Screens never accept inbound connections, so the VLAN needs no inbound rules.
Screenly already assumes its devices sit on a hostile network. The VLAN limits the other direction: what a compromised device elsewhere on your network can reach.
If a ScreenlyOS screen shows an internal page, have that service require the screen’s client certificate rather than trusting everything on the VLAN. This needs ScreenlyOS 26.2.0 or newer, and Allow sending client certificate turned on in the content item’s advanced settings, or the screen never presents the certificate and the service turns it away. Check the certificate’s common name, not only the chain, because every Screenly device shares the same authority. See Client certificates for the setup and Device certificates for downloading them.
A ScreenlyOS screen can also reach internal pages over your Tailscale network rather than directly. See Reaching your private network.
Turn on Privacy mode for screens that show sensitive information, so their screenshots are never captured or stored. See Screenshots.
Player Max BIOS
A Player Max uses Secure Boot, so it only starts software Screenly signed. Two BIOS settings stop somebody with physical access and a keyboard from changing that.
- Set a BIOS password, so firmware settings cannot be changed without it.
- Set the boot order to the internal drive only, so the player cannot be started from a USB stick.
The boot order on its own does nothing, because anyone could change it back. Set the password first.
To get into the BIOS, follow the first steps of Power on automatically for your model: Mk1, Mk2, or Mk3.
Keep the BIOS password where the people who maintain the players can find it. Every later BIOS change needs it, including the power-loss setting and anything Screenly support asks you to change during a reinstall.