Access Policies

Duration25 minLevelAdvancedOfferModule Bastion

Objectives

• I know the three scopes: Global, Admin, and Group
• I know how to choose the action in case of a violation
• I know how to restrict by browser, system, VaultysID security, and IP address
• I know that a group policy takes precedence over the global policy

0 / 4 objectives achieved — check them off as you go through the lesson.

Why It's Useful

A strong identity is not always enough: from which device, which browser, which network are we connecting? Access policies answer these questions without a VPN. They apply at the time of authentication, and you choose what happens when a rule is not followed: allow, warn, require validation from an administrator, or block.

Your Turn

Don't lock yourself out

Before choosing Block, test your rules with Warn, on an account that is not yours. A wrongly entered IP address rule in the Admin policy may prevent you from reconnecting.

1. Go to Configuration, tab Policies. → Access Rules
2. Click on Create a global policy.
3. In Action in case of violation, choose Warn.
4. Browse the tabs of the editor: Browsers, Operating Systems, Browser Security, VaultysID Security, and IP Addresses. Exclude for example a browser that you do not use.
5. Log in with this browser from a test account: access is granted with a warning.
6. Click on Add a policy and create a Group policy. In Members & Folders, associate it with a folder, then require in VaultysID Security the level Passkey.
7. Change the action of this policy to Admin Approval, and log in with a member of the folder from a new browser: access remains suspended until your validation (see the next lesson).

Action in case of violation	Effect
Allow	Rules are ignored
Warn	Access granted, user is informed
Admin Approval	Access suspended until validated by an administrator
Block	Access denied

info

There can only be one Admin policy. Group policies, however, can be as many as necessary, and their rules take precedence over the global policy for the affected users.

Check Your Knowledge

1A group policy and the global policy contradict each other for a user in the group. Which one applies?

2Which action allows the user to pass while informing them that a rule is not being followed?

3How many Admin policies can we create?

4What level of VaultysID security corresponds to a physical security key?

Key Takeaways

• Three scopes: Global, Admin (one only), and Group (priority).
• Five dimensions: browser, system, browser security, VaultysID security, IP.
• Test in Warn before Block.

Next lesson: Control Devices