The portal always opens in its own separate window, where:
• Two-factor authentication (authenticator app) is required — no exceptions
• You're signed out after 5 minutes of inactivity, and the window closes
• Every session hard-expires after 12 hours, even if active
• Strong passwords rotate every 90 days