v0.1.0-draft AI Drafted
Home / Guides / Monday.com

Monday.com Hardening Guide

Productivity Last updated: 2025-12-14

Work OS security for board sharing, app restrictions, and API token controls

Overview

Monday.com is a work operating system managing projects, workflows, and team collaboration. REST API, OAuth apps, and marketplace integrations access board data and automations. Compromised access exposes project status, resource allocation, and business processes.

Intended Audience

  • Security engineers managing productivity tools
  • Monday.com administrators
  • GRC professionals assessing workflow security
  • Third-party risk managers evaluating work management integrations

Table of Contents

  1. Authentication & Access Controls
  2. Board & Workspace Security
  3. Integration Security
  4. Monitoring & Detection

1. Authentication & Access Controls

1.1 Enforce SSO with MFA

Profile Level: L1 (Baseline) NIST 800-53: IA-2(1)

ClickOps Implementation

Step 1: Configure SAML SSO (Enterprise)

  1. Navigate to: Admin → Security → Login
  2. Configure SAML settings
  3. Enable: Require SSO

Step 2: Enable 2FA

  1. Navigate to: Admin → Security
  2. Enable: Require 2FA for all users

1.2 User Permission Levels

Profile Level: L1 (Baseline) NIST 800-53: AC-3, AC-6

ClickOps Implementation

Step 1: Define User Types

Type Permissions
Admin Full account access
Member Create/edit boards
Viewer View only
Guest Specific boards only

Step 2: Configure Workspace Access

  1. Create workspaces per team/project
  2. Set workspace permissions
  3. Limit cross-workspace access

2. Board & Workspace Security

2.1 Configure Sharing Defaults

Profile Level: L1 (Baseline) NIST 800-53: AC-21

Description

Control board sharing and external access.

Rationale

Attack Scenario: Shareable board links expose project details; guest access to sensitive boards leaks competitive information.

ClickOps Implementation

Step 1: Board Sharing Restrictions

  1. Navigate to: Admin → Security
  2. Configure:
    • Shareable links policy
    • Guest permissions
    • External sharing defaults

Step 2: Workspace Visibility

  1. Set default workspace visibility
  2. Restrict public workspaces
  3. Control member invitations

2.2 Data Export Controls

Profile Level: L2 (Hardened) NIST 800-53: SC-28

ClickOps Implementation

Step 1: Restrict Exports

  1. Navigate to: Admin → Security
  2. Configure export permissions
  3. Audit bulk exports

3. Integration Security

3.1 Manage Apps

Profile Level: L1 (Baseline) NIST 800-53: CM-7

ClickOps Implementation

Step 1: Audit Installed Apps

  1. Navigate to: Admin → Apps
  2. Review all installed apps
  3. Remove unused apps

Step 2: App Installation Policy

  1. Configure: App restrictions
  2. Require admin approval
  3. Review OAuth scopes

3.2 API Token Security

Profile Level: L1 (Baseline) NIST 800-53: IA-5

Implementation

Step 1: Manage API Tokens

  1. Navigate to: Developer → My Access Tokens
  2. Audit all tokens
  3. Revoke unused tokens

Step 2: Scoped Token Usage

  1. Create tokens per integration
  2. Use minimum required scopes
  3. Document token purposes

4. Monitoring & Detection

4.1 Audit Log (Enterprise)

Profile Level: L1 (Baseline) NIST 800-53: AU-2, AU-3

ClickOps Implementation

Step 1: Access Audit Logs

  1. Navigate to: Admin → Security → Audit
  2. Review login and activity events
  3. Configure log retention

Detection Focus

-- Detect bulk board access
SELECT user_email, board_count
FROM monday_audit_log
WHERE action = 'board_view'
  AND timestamp > NOW() - INTERVAL '1 hour'
GROUP BY user_email
HAVING board_count > 30;

-- Detect guest additions
SELECT admin_email, guest_email, board_name
FROM monday_audit_log
WHERE action = 'guest_invited'
  AND timestamp > NOW() - INTERVAL '7 days';

Appendix A: Edition Compatibility

Control Standard Pro Enterprise
SAML SSO ❌ ❌ ✅
SCIM ❌ ❌ ✅
Audit Logs ❌ ❌ ✅
IP Restrictions ❌ ❌ ✅

Changelog

Date Version Maturity Changes Author
2025-12-14 0.1.0 draft Initial Monday.com hardening guide Claude Code (Opus 4.5)