Policies
Policies decide what happens when someone signs in to your domain. A policy can allow the sign-in, require MFA, or deny it.
Open Identity from the product switcher, then select Policies in the sidebar.
The policies list
The list has two buttons:
- Discover from AD — suggests policies from the groups and OUs in your directory.
- New policy — opens the policy editor.
| Column | Description |
|---|---|
| Policy name | The policy's name. |
| Action | Allow, MFA Required, or Deny. |
| Scope | Who the policy covers. |
| AD groups / users | The groups, users, and OUs in scope. |
| Auth | The authentication type (Active Directory). |
| Enforcement | The domain's mode: Monitor or Enforce. This comes from the identity source, not the policy. |
| Status | Active, Paused, or Pending. |
| Updated | Last modified time. |
Row menu
| Item | What it does |
|---|---|
| Update policy | Opens the policy in the editor. |
| Approve | Approves the policy. Shown only if it is not approved yet. |
| Pause / Re-activate | Stops or resumes the policy. |
| Revoke | Revokes the policy. |
| Delete policy | Removes the policy. |
Older risk-based policies show a notice: "Created with risk-based evaluation, which the evaluator doesn't run. It evaluates as a static policy."
Create a policy
Click New policy. The editor has two steps: 1 · Define policy and 2 · Review & publish.
Step 1 — Define policy
Basics
| Field | Description |
|---|---|
| Policy name | Required. |
| AD domain | The connected domain the policy applies to. |
| Auth type | Active Directory. RADIUS is coming soon. |
| Policy type | Static. Risk-Based is coming soon. |
Action
| Action | Result |
|---|---|
| Allow | The sign-in goes through. |
| MFA Required | The user gets a push. The sign-in waits for the answer. |
| Deny | The sign-in is blocked. |
Scope
Pick who the policy covers:
- AD groups
- AD users
- Organizational units
- Apply to every user in this domain
Context
Context narrows when the policy applies. Leave a field empty or on "All" to match everything.
| Field | Options | Examples |
|---|---|---|
| Protocol | Kerberos, NTLM, LDAP, SMB. Empty = all protocols. | NTLM only |
| Source | All devices or Specific sources (IP or CIDR) | 10.0.5.20, 10.0.0.0/16 |
| Destination | All or Specific | *, cifs/*, cifs/fileserver01, fileserver01 |
MFA prompt
When the action is MFA Required, you can edit the text of the push. The default is:
$user is signing in to $destination via $protocol from $source
| Variable | Value |
|---|---|
$username | The user's sign-in name. |
$user | The user. Currently this also returns the username. |
$domain | The AD domain. |
$source | The source IP of the sign-in. |
$destination | The target service or host. |
$protocol | Kerberos, NTLM, LDAP, or SMB. |
Duo Security shows the prompt in the push. Okta Verify may not display it.
Step 2 — Review & publish
The review step shows:
- Monitor-mode warning — if the domain is in Monitor, a warning appears with a Switch … to Enforce link. Policies do not block or push anyone until the domain is enforcing.
- Impact — the users the policy matches.
- What will be published — a summary of the policy.
- Dry run — pick an AD user and a Protocol, then click Run. The dry run tests the currently published policy set.
If the new policy conflicts with existing ones, publishing stops with "Not published — N conflicting…". Review the conflicts. Click publish anyway to publish regardless.
How policies are applied
| Situation | Result |
|---|---|
| No policy matches the sign-in | Allowed. This is true in Monitor and Enforce. |
| Identity source in Monitor | Every verdict becomes allow. No push is sent. |
| Identity source in Enforcing | The matching policy's action is applied. |
| Push denied, expired, or timed out | The identity source's Fallback setting applies. |
| AuthNull unreachable | The Fallback setting applies to every sign-in. |
| A policy targets the user but does not cover this sign-in | Allowed. The reason is logged. |
With Fallback set to Allow, a denied or timed-out push still lets the user in. Set Fallback to Deny if a denied push must block the sign-in. Fallback is set when you connect the domain.
Tenant compliance mode
The tenant's Audit / Policy / Live mode (see Tenant Configuration) has one effect on Identity: in Live mode, policies marked not allowed are excluded. Monitor or Enforce is set per identity source, not by the tenant mode.
Roll out safely
- Keep the identity source in Monitoring while you build policies.
- Use Dry run on the review step to test real users and protocols.
- Check Logs for the sign-ins you expect.
- On Identity Sources, switch the source's Mode to Enforcing.
MFA pushes go through your configured provider: Duo Security or Okta Verify. AuthNull Authenticator is coming soon. See MFA Providers.
Retired features
| Feature | Status |
|---|---|
| Notify action | Retired. Existing Notify policies show as Allow with "ACTION RETIRED". |
| Per-policy Online / Monitor / Offline mode | Removed. Mode is set per identity source. |
| Risk-based policies | Coming soon. New ones cannot be created. |