Policies

A policy decides who may sign in to an application, how strong the sign-in must be, and from where. These guides explain how a decision is made, then how to create a policy, write rules, restrict access by network, choose backup providers, and test a change before people meet it.

Read how sign-in decisions work first. The other guides build on its terms.

1. How sign-in decisions work

   How providers, sign-in strength, policies, rules and access rules combine into one decision.

2. Create and assign a policy

   The Add policy wizard screen by screen, then assigning the policy to applications, with Acme Corp examples.

3. Rules and conditions

   Every condition and outcome in the rule editor, including risk score, time and network, with nine worked examples.

4. Access rules

   One organization-wide list that decides which applications signed-in people may reach.

5. Network zones

   What network zones are, where the console shows them and how to restrict access by IP address.

6. Failover

   Choose backup providers for a policy, the failover modes, the coverage check and what people see at sign-in.

7. What if and Test

   Simulate a policy or rule without signing anyone in: the What if page, the Test dialog and the application Test tab.

8. Defaults and monitoring

   Watch a new rules version on real sign-ins before enforcing it, and set the default and Admin Console policies.