Conditional access - overview
Conditional access allows you to set policies that dictate how and
when a user should be able to access their account. For example, you can
set conditions that allow a user to sign in to their Zoho account only
on certain days of the week, from certain locations, or through certain
devices.
Conditions
When
a policy is applied to a user, the conditions are checked for their
current sign-in attempt. If the conditions match, the corresponding
action will be done. Currently, the following conditions are supported:
- Day of the week
- Time of the day
- Platform:
This condition checks the OS of the device the user is signing in from.
Supported options are: Windows, Mac, Linux, Android, iPhone, and iPad.
- Applied routing policy: This condition checks whether the user is assigned to the mentioned routing policies or not. Learn more about routing policies
- Device management status: These are conditions based on the Device Management feature. This condition checks whether the device is managed via MDM or not and what the Device Security Score of the device should be. Learn more about device management
- IP address: This condition checks whether the user is trying to sign in from the approved IPs or not. IPs can be added in three ways:
- Current IP: The IP you're accessing Zoho Directory from when setting up the policy is detected and auto-filled.
- Static IP: You can enter a specific IP address manually.
- IP Range: You can enter a range of IPs manually.
- Country: This condition checks the geographical location from where the user is trying to sign in.
Actions
Actions
dictate how the sign-in attempt is handled when it matches the
conditions of a policy applied to a user. There are three possible
actions:
- Allow:
If the user's sign-in attempt matches with any of the policies applied
to them with the Allow action, they will be allowed to sign in.
- Allow with MFA:
If the user's sign-in attempt matches with any of the policies applied
to them with the Allow with MFA action, they will be asked to verify
with MFA before being allowed to sign in.
- Deny:
If the user's sign-in attempt matches with any of the policies applied
to them with the Deny action, they will not be allowed to sign in.
Policies with the Allow action are checked first, Allow with MFA next, Deny last. If none of the policies match, then the default action is applied.
MFA Factors
When the Allow with MFA
action is selected, you will be asked to set which MFA factors have to
be used when a user matches that specific policy. The supported factors
are:
- Zoho OneAuth - Zoho's own authenticator app. Learn more
- OTP Authenticator - Any 2FA authenticator app. Learn more
- Security Key - A hardware security key. Learn more
Since these factors are configured separately for each policy, the order of priority is important for MFA policies. Learn more about policy priority
Default Action
When
conditional access is set up, and a user's sign-in attempt doesn't
match with any policies or fails all matching policies, the default
action is carried out. The options are the same as any other
policy—Allow, Allow with MFA, and Deny.
When planning your conditional access setup, it is suggested to stick with one of two approaches:
- Allow by default: In this approach, set your default action to be Allow or Allow with MFA. Then set up all other policies with the Deny action.
In other words, during each sign-in attempt, Zoho Directory will check
the Deny conditions to see if there is any reason to deny access. If
there are no reasons, then the user will be allowed to sign in.
Example policies would be having conditions such as: - Deny if the sign-in attempt is not from the selected countries
- Deny if the sign-in attempt is on a Sunday
- Deny if the sign-in attempt is not from the selected IP addresses
- Deny by default: In this approach, set your default action to be Deny. Then set up all other policies with the Allow or Allow with MFA action.
During each sign-in attempt, Zoho Directory will check if the sign-in
attempt matches any of the allowed conditions. If it doesn't, then the
user will not be allowed to sign-in. Example policies would be having
conditions such as:
- Allow if the sign-in attempt is between 9AM and 6PM
- Allow with MFA if the sign-in attempt is from a managed device
- Allow if the sign-in attempt is from a Mac laptop
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho Writer?
Create. Review. Publish.
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Conditional Assignment - Overview
What is conditional assignment? Conditional Assignment removes the time-consuming task of assigning apps individually to users by automating it based on preset conditions. The conditions are triggered whenever confirmed users are added to or removed ...Rename conditional access policy
The steps to rename conditional access policy vary for the User Interface versions supported in Zoho One. Select the UI version you use from the tabs below and proceed with the steps that follow. Spaces UI Unified UI Spaces UI Sign in to Zoho One, ...Deactivate conditional access policy
The steps to deactivate conditional access policy vary for the User Interface versions supported in Zoho One. Select the UI version you use from the tabs below and proceed with the steps that follow. Spaces UI Unified UI Spaces UI Sign in to Zoho ...Delete conditional access policy
The steps to delete conditional access policy vary for the User Interface versions supported in Zoho One. Select the UI version you use from the tabs below and proceed with the steps that follow. Spaces UI Unified UI Spaces UI Sign in to Zoho One, ...Edit conditional access policy
The steps to edit conditional access policy vary for the User Interface versions supported in Zoho One. Select the UI version you use from the tabs below and proceed with the steps that follow. Spaces UI Unified UI Spaces UI Sign in to Zoho One, then ...
New to Zoho LandingPage?
Zoho LandingPage Resources