Unified login provides two settings for building authentication policies that are both secure and sustainable for your staff: Where criteria and Allow Challenge Deferral. Used together, they require stronger authentication when risk is highest and reduce unnecessary friction for staff.
Every authentication policy can include an optional Where criteria. This condition scopes when the policy applies based on the user's IP address at the time of sign-in. You can specify a single IP address or a CIDR range, such as your organization's network.
If a user qualifies for more than one authentication policy, unified login enforces the strongest applicable policy. Adding a more convenient on-site policy does not weaken your off-site requirements. For example, if a staff member's account matches both an on-site policy that requires a password only and a general staff policy that requires multifactor authentication (MFA), unified login applies the MFA policy.
Allow Challenge Deferral is a setting that lets staff accounts remember a trusted device after a successful temporary one-time password (TOTP) sign-in. Unified login registers the device as trusted and on future sign-ins from that device, the TOTP challenge is deferred for a configurable period. After the deferral period expires, the staff member is prompted for TOTP again to re-establish trust.
The deferral period determines how long a device stays trusted before requiring TOTP again. A shorter period of 7 to 14 days is appropriate for high-risk roles or environments where devices are frequently shared. A period of 30 to 90 days works well for most staff with individually assigned devices.
Allow Challenge Deferral supports a layered, defense-in-depth approach rather than reducing security. When staff complete TOTP on every sign-in, MFA fatigue can lead to informal workarounds that introduce risk. With Allow Challenge Deferral, TOTP registers the device rather than proving identity on every login, and the device itself becomes a second factor because access to it required passing TOTP.
The following two-policy setup is a recommended configuration for most organizations:
- On-site policy
-
Set the Where criteria to Is one of and include your network IP ranges. Set the required methods to password and MFA, and enable Allow Challenge Deferral. Staff on your network using a trusted, registered device can sign in with their password only. Staff on your network using a new or unrecognized device are prompted for TOTP to register the device.
- Off-site policy
-
Set the Where criteria to Not one of and include your network IP ranges. Set the required methods to password and MFA, and disable Allow Challenge Deferral. Staff signing in from outside your network always complete MFA, regardless of device trust status.