Conditional access - overview
Conditional access allows you to set policies that dictate how and when a user should be able to access their account. For example, you can set conditions that allow a user to sign in to their Zoho account only on certain days of the week, from certain locations, or through certain devices.
Conditions
When a policy is applied to a user, the conditions are checked for their current sign-in attempt. If the conditions match, the corresponding action will be done. Currently, the following conditions are supported:
- Day of the week
- Time of the day
- Platform: This condition checks the OS of the device the user is signing in from. Supported options are: Windows, Mac, Linux, Android, iPhone, and iPad.
- Applied routing policy: This condition checks whether the user is assigned to the mentioned routing policies or not. Learn more about routing policies
- Device management status: These are conditions based on the Device Management feature. This condition checks whether the device is managed via MDM or not and what the Device Security Score of the device should be. Learn more about device management
- IP address: This condition checks whether the user is trying to sign in from the approved IPs or not. IPs can be added in three ways:
- Current IP: The IP you're accessing Zoho Directory from when setting up the policy is detected and auto-filled.
- Static IP: You can enter a specific IP address manually.
- IP Range: You can enter a range of IPs manually.
- Country: This condition checks the geographical location from where the user is trying to sign in.
Actions
Actions dictate how the sign-in attempt is handled when it matches the conditions of a policy applied to a user. There are three possible actions:
- Allow: If the user's sign-in attempt matches with any of the policies applied to them with the Allow action, they will be allowed to sign in.
- Allow with MFA: If the user's sign-in attempt matches with any of the policies applied to them with the Allow with MFA action, they will be asked to verify with MFA before being allowed to sign in.
- Deny: If the user's sign-in attempt matches with any of the policies applied to them with the Deny action, they will not be allowed to sign in.
Policies with the Allow action are checked first, Allow with MFA next, Deny last. If none of the policies match, then the default action is applied.
MFA Factors
When the Allow with MFA action is selected, you will be asked to set which MFA factors have to be used when a user matches that specific policy. The supported factors are:
- Zoho OneAuth - Zoho's own authenticator app. Learn more
- OTP Authenticator - Any 2FA authenticator app. Learn more
- Security Key - A hardware security key. Learn more
Since these factors are configured separately for each policy, the order of priority is important for MFA policies. Learn more about policy priority
Default Action
When conditional access is set up, and a user's sign-in attempt doesn't match with any policies or fails all matching policies, the default action is carried out. The options are the same as any other policy—Allow, Allow with MFA, and Deny.
When planning your conditional access setup, it is suggested to stick with one of two approaches:
- Allow by default: In this approach, set your default action to be Allow or Allow with MFA. Then set up all other policies with the Deny action. In other words, during each sign-in attempt, Zoho Directory will check the Deny conditions to see if there is any reason to deny access. If there are no reasons, then the user will be allowed to sign in.
Example policies would be having conditions such as: - Deny if the sign-in attempt is not from the selected countries
- Deny if the sign-in attempt is on a Sunday
- Deny if the sign-in attempt is not from the selected IP addresses
- Deny by default: In this approach, set your default action to be Deny. Then set up all other policies with the Allow or Allow with MFA action. During each sign-in attempt, Zoho Directory will check if the sign-in attempt matches any of the allowed conditions. If it doesn't, then the user will not be allowed to sign-in. Example policies would be having conditions such as:
- Allow if the sign-in attempt is between 9AM and 6PM
- Allow with MFA if the sign-in attempt is from a managed device
- Allow if the sign-in attempt is from a Mac laptop
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho Writer?
Create. Review. Publish.
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Groups - Overview
Groups are used in Zoho Directory to simplify user management. Groups allow you to provide app access to and enforce security policies for multiple users simultaneously. If you're using Zoho Mail, you will also be able to create email aliases for ...Rename conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to rename, then click Rename. Enter the new name, then click Rename.Delete conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to delete, click the icon, then click Delete. Confirm your action by clicking Delete ...Deactivate conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to deactivate, click the icon, then click Deactivate. Confirm your action by clicking ...Edit conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to edit. Use the sub-tabs to edit the policy: Policy Info: You can add or remove users to ...
New to Zoho LandingPage?
Zoho LandingPage Resources