Policy-Based Access Control

Every sign-in AuthNull protects is matched against a policy. The policy decides who may sign in, to what, and whether they must approve a push first.

Policy Actions

Each policy has one action. The labels differ slightly between products:

Product	No MFA	Push required	Blocked
Identity	Allow	MFA required	Deny
Database	Allow	Require MFA	Block
RADIUS	Allow	MFA Required	Deny
PAM	Allow (administrators only)	Require approval (the default)	Deny

With the push action, the user must approve a push from your MFA provider before the sign-in completes.

Where Policies Live

Each product has its own Policies screen - choose the product with Switch product, then open Policies:

Product	A policy matches on	Guide
Identity	Directory users, groups, OUs, or domain; sources; destinations; protocols	Identity MFA
Database	Console users (IAM users), database, database user, and privileges	Database MFA Policies
RADIUS	Directory users, groups, or OUs; network devices; stations; and RADIUS service types	RADIUS MFA
PAM	Who may reach which accounts on which endpoints, through which gateway - optionally with time-limited sudo	PAM MFA

note

A RADIUS login that no policy covers is allowed through, so a VPN keeps working before any RADIUS policy is written. Add a policy to require MFA.

Policy Modes

How strictly policies are applied is set per tenant under Settings → Tenant Configuration → Authentication policy. See Policy Modes.

More

• Policy Modes - Audit, Policy, and Live mode
• Policy FAQ