Creating a Conditional Access Policy

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Conditional access policies allow administrators to secure application access based on specific conditions and controls. These policies ensure that only permitted users can access protected resources, reducing misuse and strengthening application security.

The conditional access policy has dependencies on both the rules and federation partner associated with it, so modifying either aspect outside of the conditional access policy can affect the configured criteria.

Requirements

  • Access to your RapidIdentity administrator portal with ShieldID enabled

  • An Advanced Authentication license

  • An existing federation partner

  1. Navigate to your RapidIdentity administrator portal.
  2. From the Dashboard pop-up menu, choose "Configuration".
  3. In the Policies section, click Conditional Access Policies.
  4. Click Add Policy.
  5. In the General tab, add a name and description for the policy, then click Save.
    1. Configure the Deferral field to determine the time until a user is prompted to re-authenticate.
    2. Configure the Help Message field to provide information to users during the authentication process.
  6. In the Protected Resources tab, add a federation partner.
    Note:

    Each conditional access policy can only be associated with a single federation partner.

  7. In the Access Control tab, configure the Default Action field in the Rules section to determine what users will experience if no rules apply to them.

    Rules are evaluated based on their priority order, with the rule at the top of the list taking priority over the rules below it.

  8. Click Add Rule.
  9. In the Rule Criteria section, modify the criteria for who, when, and where this policy should be in effect.

    For example, the policy can apply to the Teachers group from Monday through Friday on the school's Wi-Fi network.

  10. In the What section, enable this policy for unknown devices or suspicious activity.
    Enabling the policy for unknown devices will target first-time successful authentications and tag them as unknown for 24 hours. Enabling the policy for suspicious activity will target authentications with three failed attempts within one hour or if a user attempts to access unauthorized resources for 24 hours.
    Note:

    The unknown devices rule only applies to static IP addresses and is browser specific. If the IP address or browser changes, the 24 hour timer will restart. For users who have dynamic IP addresses or use multiple browsers, this rule may not function as intended.

  11. Click Save.

The conditional access policy now enforces the configured criteria for the selected users.