Creating an authentication policy

Log in to Yandex Identity Hub.

In the left-hand panel, select Security settings and go to the Authentication policies tab.

Click Create policy.

In the Name field, enter a name for the policy.

Optionally, provide the policy description in the Description field.

Optionally, set labels for the policy in the Labels field.

Make sure the Policy active option is enabled.

Set the policy Conditions:

1. Under Users and groups, specify users or groups your policy will apply to:

   1. In the Include field, select:

      • All users: Your newly created authentication policy will apply to all users of the organization.

      • Selected: Your policy will apply to selected users and/or user groups.

        Click Add to select users or user groups the policy will apply to. If required, use the search bar.

   2. Optionally, in the Exclude field, click Add to select users or user groups the policy will not apply to.

      Note

      You cannot specify the same users or user groups simultaneously in both inclusion and exclusion lists.

2. Under Apps, specify the applications for which authentication will be managed by the policy you are creating:

   1. In the Include field, select:

      • All apps: To ensure the policy applies to authentication by users connecting from any applications of the organization.

      • Selected: To apply the policy only to authentication in selected applications.

        In the field that appears, select the applications you need. If required, use the search bar and enter the application name or ID.

   2. Optionally, under Exclude, select the applications for which the policy will not be applied to authentication.

      Note

      You cannot specify identical applications simultaneously in both inclusion and exclusion lists.

3. Under Networks and IP addresses, specify the IP addresses for the policy to allow or deny user authentication from:

   1. In the Include field, select:

      • Any networks: For the policy to apply to user authentication events from any IP address.

      • Selected: For the policy to apply to user authentication events from IP addresses in specified ranges.

        In the field that appears, enter one or more IPv4 or IPv6 address ranges in CIDR notation.

   2. Optionally, in the Exclude field, specify the IP address ranges to exclude from the policy.

      Note

      You cannot specify the same IP address ranges in both inclusion and exclusion lists at the same time.

4. Under Result, select an action to apply to the authentication event that matches the policy criteria.

   Currently, you can only use authentication policies to deny authentication.

5. Click Create policy.