- \n
- Desktop access policies using Device Trust Certificates are only supported on the following browsers:\n
- \n
- Windows: Google Chrome, Microsoft Edge<\/li>\n\n\n\n
- macOS: Google Chrome, Safari<\/li>\n\n\n\n
- Linux: Google Chrome<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Mobile devices are supported using Mobile Device Trust. See Get Started: Mobile Device Trust<\/a> to learn more. <\/li>\n\n\n\n
- An access policy becomes a conditional access policy when you add a condition. Adding a condition for the User Portal or SSO Applications is a Premium feature and is part of our Platform Prime plan.<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nYou can remotely apply policies that make your managed devices and third-party apps secure and meet compliance levels. See Get Started: Policies<\/a>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Conditional Access Policies List View <\/h2>\n\n\n\n
To find the list view, log in to the 探花大神 Admin Portal<\/a> and go to\u00a0SECURITY MANAGEMENT<\/strong>\u00a0>\u00a0Conditional Policies<\/strong>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/06\/cap-list-view-1-1024x793.png\")
<\/figure>\n\n\n\nFrom the list view you can: <\/p>\n\n\n\n
- \n
- See a list of the access policies that you\u2019ve configured.<\/li>\n\n\n\n
- Configure (or delete) new access policies for the User Portal, SSO Applications, or 探花大神 LDAP.\n
- \n
- See Configure a Conditional Access Policy<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Access the Conditional Policy Settings page, where you can enable Certificate Distribution and manage Default Access Policies. To make changes to these policies, click Edit in Settings<\/strong> under Default Access Policies<\/strong>.\n
- \n
- See Set a Default Access Policy<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Understanding Policy Precedence<\/h2>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nConditional Access Policies work in conjunction with Default Access Policies. If none of the set access policies apply to a user, the Default Access Policies are enforced as fallback policies.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Before you create several access policies, it\u2019s important to understand policy precedence so that you don\u2019t accidentally lock out your users. When you have several policies enabled, the policy precedence is the following:<\/p>\n\n\n\n
- \n
- A policy set to deny access is first priority.<\/li>\n\n\n\n
- A policy set to allow access with MFA is second priority.<\/li>\n\n\n\n
- A policy set to allow access without MFA is third priority. <\/li>\n<\/ul>\n\n\n\n
This means if several policies with different actions apply to a single user, the policy that denies access takes effect over policies that allow access with or without MFA. <\/p>\n\n\n\n
For example: consider these two policies:<\/p>\n\n\n\n
- \n
- One policy denies access to the User Portal if a user isn\u2019t on an approved network (conditional). You include a specific user group with this policy.<\/li>\n\n\n\n
- Another policy allows access to the user portal with MFA. You include all your users with this policy. <\/li>\n<\/ul>\n\n\n\n
Result: If a user is included in both policies and they try to log in to the User Portal from an unapproved network, they\u2019re denied access. <\/p>\n\n\n\n
With that in mind, we recommend being very specific when you create a policy that denies access. If you\u2019re not careful, you could prevent your users from being able to access resources. <\/p>\n\n\n\n
When no conditional access policies apply to a user, the Default Access Policy takes effect. For example, say you have:<\/p>\n\n\n\n
- \n
- An access policy that allows access without MFA.<\/li>\n\n\n\n
- A user who isn\u2019t included in the policy.<\/li>\n\n\n\n
- The Default Access Policy set to allow access with MFA.<\/li>\n<\/ul>\n\n\n\n
In this case, the user is required to authenticate with MFA. <\/p>\n\n\n\n
Supported Resources<\/h2>\n\n\n\n
You can create access policies for the User Portal, SSO applications, and LDAP applications. An access policy becomes a conditional access policy when you add a condition. Adding a condition for the User Portal or SSO Applications is a Premium feature and is part of our Platform Prime plan. <\/p>\n\n\n\n
A policy can only have one resource type associated with it, so you can\u2019t have one policy that applies to both the User Portal and SSO Applications. <\/p>\n\n\n\n
- \n
- User Portal: Configure a policy that relaxes, restricts, or denies access to the User Portal.\n
- \n
- For example, use a device condition to let users log in to the User Portal without MFA when they\u2019re on a 探花大神-managed device, or set a policy across all your users that requires MFA to access the User Portal. <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \nTo avoid account lockout and password reset failure issues, we recommend informing your users to set up an MFA factor in their User Portal before<\/strong> you apply a conditional access policy to the User Portal. For user instructions on how to do this, see Set up an Authenticator App<\/a>.<\/p>\n\n\n\n
<\/p>\n\n\n\n
You can also enable your users to reset their password when MFA is enforced for the User Portal but they have not yet enrolled. See Manage Password and Security Settings<\/a>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- SSO Applications: Use a policy to relax, restrict or deny access to SSO applications when users access them from the User Portal or through service provider-initiated authentication.\n
- \n
- For example, enable a policy for your software engineer user groups that requires them to use MFA when they access AWS and GitHub applications.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- LDAP Applications: Use a policy to relax, restrict or deny access to LDAP applications when users access them from the User Portal.\n
- \n
- For example, enable a policy for your users that requires them to use MFA when accessing the VPN.<\/li>\n\n\n\n
- Note that conditions are not applicable for LDAP access policies.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- SSO Applications: Use a policy to relax, restrict or deny access to SSO applications when users access them from the User Portal or through service provider-initiated authentication.\n
- For example, use a device condition to let users log in to the User Portal without MFA when they\u2019re on a 探花大神-managed device, or set a policy across all your users that requires MFA to access the User Portal. <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- User Portal: Configure a policy that relaxes, restricts, or denies access to the User Portal.\n
- Access the Conditional Policy Settings page, where you can enable Certificate Distribution and manage Default Access Policies. To make changes to these policies, click Edit in Settings<\/strong> under Default Access Policies<\/strong>.\n
- See Configure a Conditional Access Policy<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- An access policy becomes a conditional access policy when you add a condition. Adding a condition for the User Portal or SSO Applications is a Premium feature and is part of our Platform Prime plan.<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\"){kind=icon}
<\/p><\/div>