Authentication policies in Yandex Identity Hub

In Yandex Identity Hub, authentication policies are used for granular management of user and user group access to Yandex Identity Hub applications by denying or allowing authentication based on conditions specified in the policy scope.

Currently, you can manage authentication policies via the Cloud Center UI. To create, update, activate, deactivate, or delete authentication policies, users need the organization-manager.admin role or higher.

Policy scopePolicy scope

Authentication policies apply to user authentication events based on the following conditions:

• Users and user groups.
• Applications.
• Networks and IP addresses.

Users and user groupsUsers and user groups

You can apply an authentication policy to all users within your Yandex Identity Hub or restrict it to specific users or user groups.

You can also explicitly exclude certain users or user groups from a policy. Note that you cannot add the same users or user groups to both inclusion and exclusion lists at the same time.

ApplicationsApplications

You can apply an authentication policy to all applications created in your Yandex Identity Hub or restrict it to specific applications.

You can also exclude certain applications from a policy.

Networks and IP addressesNetworks and IP addresses

You can apply an authentication policy to either all possible IP addresses or specific IPv4 and IPv6 ranges in CIDR notation.

You can also exclude certain address ranges from a policy. Note that you cannot add the same IP address ranges to both inclusion and exclusion lists at the same time.

Policy outcomesPolicy outcomes

Currently, you can use authentication policies to deny user authentication if the authentication event meets the policy conditions.

Policy statusesPolicy statuses

An authentication policy may be either Active or Inactive. An inactive policy does not apply to user authentication events.

Useful linksUseful links

• Creating an authentication policy
• Activating/deactivating an authentication policy
• Editing an authentication policy
• Deleting an authentication policy
• Applications in Yandex Identity Hub