Reorder MFA policies
Conditional Access Policies can be configured with three types of actions: allow, deny, and allow with MFA.
When a user tries signing in, they are first checked if they are part of an allow policy. If they are, and if their current sign-in attempt matches the conditions of the allow policy they are part of, they are allowed to sign in.
If they are not part of an allow policy, or don't pass the conditions of the allow policies they are part of, they are then checked against the allow with MFA policies. Again, if they don't fit into any of those, they are checked with the deny policies. If they don't fit in with any of the policies, the default policy is applied to them.
Out of these, allow and deny policies are straightforward; a user only has to pass against one of the policies they are part of, and the corresponding action is applied to them. For example, if they are a part of three allow policies, pass the conditions of one of the policies, and fail two policies, they will still be allowed to sign in. No further check is done.
MFA policies are different, as the specific policy a user passes is also checked. MFA policies have extra configurations: you decide which MFA factors a user is allowed to use, how long they can trust browser sessions, and whether they can use a backup code to bypass MFA.
Consider an example: A user is part of two MFA policies and passes the conditions of both. Let's say MFA policy 1 allows using only OneAuth, MFA policy 2 allows using only a hardware security key. Now during sign-in, a decision has to be made on which MFA factor should be allowed for the user; OneAuth or hardware security key.
To solve such cases, you will be able to set priorities for MFA policies when adding a policy. The policies are checked sequentially, and the MFA configuration of the first policy that a user passes is applied to the user. In our example, if MFA policy 1 had the higher priority, then the user would be allowed to use only OneAuth for signing in.
To reorder MFA policies after adding them:
- Sign in to Zoho Directory, then click Admin Panel in the left menu.
- Go to the Security tab, then go to Conditional Access Policies.
- Click Reorder Conditional Policy.
- Drag and drop the policies to reorder. The first policy has the highest priority, and the last one has the lowest priority.
- Click Reorder once you're done to save your changes.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho Writer?
Create. Review. Publish.
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Conditional access - overview
Conditional access allows you to set policies that dictate how and when a user should be able to access their account. For example, you can set conditions that allow a user to sign in to their Zoho account only on certain days of the week, from ...Add conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click Add Policy. Enter a name for your policy, and choose what type of action should be taken based on your policy. ...Rename conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to rename, then click Rename. Enter the new name, then click Rename.Delete conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to delete, click the icon, then click Delete. Confirm your action by clicking Delete ...Deactivate conditional access policy
Sign in to Zoho Directory, then click Admin Panel in the left menu. Go to the Security tab, then go to Conditional Access Policies. Click on the policy you want to deactivate, click the icon, then click Deactivate. Confirm your action by clicking ...
New to Zoho LandingPage?
Zoho LandingPage Resources