# Authentication policy - Link: https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/authentication-policy/ - Published: 2026-08-24T01:47:17+00:00 - Author: Don Bowman 1. [Home](https://www.agilicus.com/) 2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/) 3. [Authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/) 4. Authentication policy ![6a9b694b-featured-anyx-admin-authenticationauthentication-policy](https://www. agilicus.com/www/6a9b694b-featured-anyx-admin-authenticationauthentication-policy. png) ## Authentication policy [CONTACT](https://www.agilicus.com/contact-us/) The **Authentication Policy** page (route `/auth-issuer-policy`) is the global control for what happens during the authentication flow: which multi-factor authentication methods are allowed, how long credentials live, which preset security posture to apply, and the ordered rules that decide whether a user may sign in. Authorisation happens per application, but authentication is global, and this page is where it is governed. ![Authentication policy overview](https://www.agilicus.com/www/dc0fd7ba-policy-overview. png) ## Purpose Authentication policy applies to every sign-in through your issuer. It has four parts: * **Multi-factor authentication methods**: which second-factor methods are enabled( time-based challenge apps and WebAuthn). * **Credential policy**: the maximum lifetime for credentials, globally and per resource type. * **Authentication rules**: preset security postures (Default, Permissive, Strict) that you can configure and apply, plus a default action for sign-in attempts that match no rule. * **Policy groups and rules**: named groups of ordered rules. Each rule has conditions and an action, and the first rule whose conditions match decides the outcome. For organisations that inherit their issuer from a parent (a sub-organisation without a unique issuer), the page shows **Inherited Policy: Yes** and the controls are disabled. ## Why use it * Enforce multi-factor authentication consistently across every application, including legacy ones (see [Identity and authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/)). * Set a security posture in one step with the Default, Permissive, or Strict presets. * Write precise rules, for example _deny sign-in from a specific IP range_, _require multi-factor authentication for a specific application or group_, or _allow single sign-on only for certain clients_. * Limit credential lifetime so stale tokens cannot be used. ## When to use it * During initial setup, to choose a preset and confirm the multi-factor authentication methods your users can enrol. * When your organisation needs a stronger or weaker posture, or a specific rule for a group of users or a client. * After a security review, to enforce shorter credential lifetimes. **Prerequisite**: permission to administer issuers (an owner or administrator role). The page shows a _no permissions_ message otherwise. ## How to use it 1. Open **Authentication > Authentication Policy** from the left navigation. 2. Confirm the **Multi-Factor Authentication Methods Enabled** checkboxes match what you support: **Time based challenge app** (a one-time code from an authenticator application) and **WebAuthn** (a security key or platform authenticator). 3. Select **CREDENTIAL POLICY** to set the maximum lifetime for credentials, globally and per resource type. ![Credential policy dialog](https://www.agilicus.com/www/dc0fd7ba-policy-credential- policy-dialog.png) 1. In the **Authentication Rules** cards, select **CONFIG & APPLY PRESET** on a preset to review and apply it. The **more** menu on a card shows **See detailed Information** for the preset. ![Preset configuration dialog](https://www.agilicus.com/www/7c54aa58-policy-preset- dialog.png) ![Preset card menu](https://www.agilicus.com/www/5ae3af37-policy-preset-card-menu. png) ![Preset details dialog](https://www.agilicus.com/www/7c54aa58-policy-preset-details- dialog.png) 1. Set the **Default Action** that applies when no rule matches. ![Default action options](https://www.agilicus.com/www/dc0fd7ba-policy-default-action- dropdown.png) 1. Organise rules into policy groups with **ADD GROUP**, or expand an existing group to manage its rules. ![Policy group expanded](https://www.agilicus.com/www/dc0fd7ba-policy-group-expanded. png) ### Working with rules Within a group, each rule has a **Rule Name**, an **Action** (for example _Authenticate with an identity provider_), and a set of conditions. Rules are evaluated in order; the first rule whose conditions all match wins. * **ADD RULE** creates a new rule in the group. * **ADD CONDITION** opens the condition wizard. * Tick conditions and select **DELETE CONDITIONS** to remove them. * **DELETE RULE** removes the whole rule. * **DELETE GROUP** removes the group and its rules. ### Creating a condition Select **ADD CONDITION** to open the **Configure Policy Condition** wizard. **Choose condition type.** Select the condition type: Client id, IP in CIDR, Successful Multi-Factor Login, Object attribute, Org id, Upstream identity provider, User has enrolled Multi-Factor method, or User id. ![Condition wizard, step 1](https://www.agilicus.com/www/c24a0142-policy-condition- dialog-step1.png) ![Condition types](https://www.agilicus.com/www/dc0fd7ba-policy-condition-types. png) For **Object attribute**, also choose a **field** to compare, for example _login session user is authenticated_ or _user member of email_. ![Field options](https://www.agilicus.com/www/dc0fd7ba-policy-condition-field-options. png) **Configure condition details.** The wizard shows the chosen condition type and field, then asks for an **operator** and a **value**. Operators are _equals_, _greater than_, _in_, _less than_, _not equals_, and _not in_. ![Condition details](https://www.agilicus.com/www/160a0f7c-policy-condition-dialog- step2.png) ![Operator options](https://www.agilicus.com/www/dc0fd7ba-policy-condition-operator- dropdown.png) ![Condition details filled](https://www.agilicus.com/www/dc0fd7ba-policy-condition- step2-filled.png) **Apply** and **Done.** Select **Add** on the Apply step to save the condition to the rule. ![Apply the condition](https://www.agilicus.com/www/96cbbd07-policy-condition-apply. png) ![Condition saved](https://www.agilicus.com/www/dc0fd7ba-policy-condition-done.png) The condition appears in the rule’s condition table. Its row menu offers **Configure Condition** to edit it. ![Condition added to the rule](https://www.agilicus.com/www/76fb0235-policy-condition- added.png) ![Condition row menu](https://www.agilicus.com/www/dc0fd7ba-policy-condition-row- menu.png) ## Fields and controls reference | Control | Purpose | Required | Default | Valid values | Notes | | Inherited Policy | Whether this organisation shares its parent’s policy | Read-only | No | Yes or No | Yes disables the configuration controls | | Time based challenge app | Enables time-based one-time codes (for example Google Authenticator, Authy) | No | On | On or off | | | WebAuthn | Enables WebAuthn (USB security key, push to phone, biometric, TPM) | No | On | On or off | | | CREDENTIAL POLICY | Opens the credential lifetime dialog | n/a | n/a | n/a | | | Default Action | The action when no rule matches | Yes | Deny Login | Require Second Factor; Deny Login; Allow Login; Authenticate with an identity provider | | | CONFIG & APPLY PRESET | Applies a Default, Permissive, or Strict preset | n/a | n/a | n/a | Opens the preset configuration dialog | | ADD GROUP | Creates a new policy group | n/a | n/a | n/a | | | ADD RULE | Creates a new rule in a group | n/a | n/a | n/a | | | ADD CONDITION | Opens the condition wizard | n/a | n/a | n/a | | | DELETE CONDITIONS | Removes the ticked conditions from a rule | n/a | n/a | n/a | | | DELETE RULE | Removes a rule | n/a | n/a | n/a | | | DELETE GROUP | Removes a group and its rules | n/a | n/a | n/a | | | Action (rule) | The action the rule takes when its conditions match | Yes | Authenticate with an identity provider | The multi-factor challenge answer results | | ### Credential policy dialog | Control | Purpose | Valid values | | Global Default Maximum Lifetime (Hours) | The fallback lifetime for credentials when no specific scope is set | A number of hours | | Ssh, Shares, Applications, Databases, Desktops, Networks | Per-resource-type maximum lifetimes | A number of hours per scope | ### Preset configuration dialog | Control | Purpose | | Multi factor required time interval (time in seconds) | How often multi-factor authentication is required | | Sessions valid for (time in seconds) | How long a session lasts | | Allow shared sessions between applications | Whether a session carries across applications | | Does not require multi factor authentication from providers | Providers exempt from multi-factor authentication (Select Providers) | | Always require multi factor authentication for applications | Applications that always require multi-factor authentication (Select Applications) | | Always require multi factor authentication for groups | Groups that always require multi-factor authentication (Select Groups) | | Apply | Applies the preset values to the policy | ## Dialogs and popups * **Credential policy**: the **CREDENTIAL POLICY** button opens the credential lifetime dialog described above. * **Auth preset**: **CONFIG & APPLY PRESET** opens the preset configuration dialog; its **more** menu opens the preset details information dialog, which has a ** Config & Apply Preset** button that leads on to the configuration dialog. * **Policy condition**: **ADD CONDITION** opens the four-step condition wizard described above. ## Configuration versus diagnostics versus confirmation * **Configuration**: the multi-factor authentication methods, credential policy, presets, default action, and the policy groups and rules. * **Diagnostics**: the inherited policy indicator is informational; there are no live diagnostics on this screen. * **Confirmation**: **DELETE RULE** and **DELETE GROUP** remove policy immediately.** CONFIG & APPLY PRESET** overwrites the policy with the preset’s settings, so review the preset dialog before applying. Changes to authentication policy affect every user sign-in. ## Pagination and async behaviour * There is no table with paging on this screen; rules are organised into expandable groups. * Policy changes save asynchronously. After applying a preset, adding a rule, or changing the default action, wait a few seconds and reload to confirm. Sign-in behaviour changes as the policy propagates to the identity-aware proxy. ## Troubleshooting * **The controls are disabled**: the organisation has an inherited policy (Inherited Policy: Yes). Give it a unique issuer to configure its own policy (see [Sub-organisations](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sub-organisations/)). * **A rule is not having an effect**: check the rule’s order (rules are evaluated top to bottom) and its conditions. Use **Configure Condition** to verify each condition’s operator and value. * **Multi-factor authentication is not offered**: confirm at least one method is enabled here, and that the user has enrolled a method. See [Multi-factor authentication](https://www.agilicus.com/product-guide/multi-factor-authentication-cfg). * **Sign-in is denied unexpectedly**: review the Default Action and the policy groups. The default in the demo organisation is **Deny Login**, so rules that allow authentication must match before the default applies. * **I want to undo a preset**: re-open the preset dialog and apply a different preset, or edit the individual rules. ## See also * [Identity and authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/) * [Authentication overview](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/overview/) * [Shared identity](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/shared-identity/) * [Custom identity](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/custom-identity/) * [Sub-organisations](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sub-organisations/) * [Authentication audit](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) * [Getting started: identify users](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/identify-users/) ## Web guide * [Authentication rules](https://www.agilicus.com/product-guide/authentication-rules) * [Multi-factor authentication](https://www.agilicus.com/product-guide/multi-factor-authentication-cfg) * [How do I enable or disable multi-factor authentication for everybody?](https://www.agilicus.com/how-do-i-enable-or-disable-multifactor-authentication-for-everybody)