Authentication policies in Yandex Identity Hub

In Yandex Identity Hub, authentication policies are used for granular management of user and user group access to Yandex Identity Hub applications by denying or allowing authentication based on the policy criteria.

Currently, authentication policies can only be managed in the Cloud Center UI. To create, update, activate, deactivate, or delete authentication policies, a user must have the organization-manager.admin role or higher.

Policy scopePolicy scope

An authentication policy can apply to user authentication events based on the following condition types:

• Users and user groups.
• Applications.
• Networks and IP addresses.

Users and user groupsUsers and user groups

You can configure an authentication policy to apply to all users in an Yandex Identity Hub organization, or to specific users or user groups.

You can also exclude specific users or user groups from the policy. Note that you cannot specify the same users or user groups simultaneously in both the inclusion and exclusion lists.

ApplicationsApplications

You can configure an authentication policy to apply to all applications created in an Yandex Identity Hub organization or to specific ones.

You can also exclude specific applications from the policy.

Networks and IP addressesNetworks and IP addresses

You can configure an authentication policy to apply to authentication from all possible IP addresses or to specific ranges of IPv4 or IPv6 addresses in CIDR notation.

You can also exclude specific IP address ranges from the policy. Note that you cannot specify the same IP address ranges in both the inclusion and exclusion lists at the same time.

Policy-driven actionsPolicy-driven actions

Currently, authentication policies can deny user authentication if the authentication event matches the policy's defined conditions.

Policy statusesPolicy statuses

The status of an authentication policy can be either Active or Inactive. Inactive policies are not applied to user authentication events.

Useful linksUseful links

• Creating an authentication policy
• Activating/deactivating an authentication policy
• Editing an authentication policy
• Deleting an authentication policy
• Applications in Yandex Identity Hub