Skip to content
Identity Studio

Conditional access & risk

Decide who gets in, from where, and with what proof

Write rules that allow, ask for MFA, block or notify. Limit networks by address range. Score each sign-in by named risk signals. Try every rule in report-only mode first and see what it would have done.

Book a demoSee the order of checks
Access rule · Admins off-networkDry run
Whenrole is admin
Andthe address is unknown
Thenask for MFA
Priority10

Dry run: this sign-in would be asked for MFA. Nothing was refused.

Why it matters

Layers you can see, test and trust

Report-only first

Every rule is evaluated and counted before it refuses anyone, and a dry run shows its answer for any sign-in.

Simple layers, strong together

Lockout, rate limits, the bot check, networks, rules and risk each do one job.

Named signals, not a black box

A risk band comes with the signals behind it, so you know why someone was asked for more.

How it works

The order of checks on every sign-in

  1. 1DoorLockout and rate limits5 failures in 15 minutes locks for 15 minutes; per-address limits on every door.
  2. 2DoorBot checkThe first-party CAPTCHA, in observe or enforce mode per surface.
  3. 3NetworkNetwork policyConsole, then organization, then application. Any matching deny wins.
  4. 4RulesConditional accessFirst matching rule by priority: allow, MFA, block or notify.
  5. 5RiskRisk bandNormal, extra verification or high risk, from named signals.
  6. 6OutcomeProceed, step up or refuseEvery decision is written to the audit trail.
Capabilities

What each layer can do

LayerHow it worksStatus
Conditional access rulesConditions: roles, people, email domains, time zones, IP ranges, weekdays, hours, unknown address, new device. Actions: allow, MFA, block, notify. Dry run any rule.Live
Enforcing access rulesRefusals and MFA demands applied to live sign-ins, per door.Early access
Network policyAllow and deny address ranges at console, organization and application scope; up to 64 ranges a rule, 50 rules a scope; an SDK evaluate call.Live
Enforcing network policyRefusing sign-ins outside the policy.Early access
Risk evaluationBands from live signals: unknown client address, recent failed attempts, refresh-token reuse, a denied push. High risk needs two signals from two groups.Early access
Approximate locationCity, region and country on sessions and approvals from an offline database, for display.Early access
Account lockoutAttempts, window and duration per organization; an organization can only tighten.Live
Rate limitsPer address: sign-in 10, sign-up 5, reset 5, MFA verify 10 a minute.Live
SessionsList and revoke one, revoke the others, sign out everywhere; admins can force sign-out.Live
Signing keysRotation with a notice window and webhook events to app owners.Live
Configuration

What admins set

OptionValuesDefault
Access rulename, conditions, action (allow, mfa, block, notify), priority, activemfa · 100
Network ruleallow or deny, up to 64 address ranges, labelnone
Lockoutattempts 2 to 20 · window 1 minute to 24 hours · duration 1 minute to 7 days5 · 15 min · 15 min
Password policyLength, character classes, history, rotation8 characters
Session timeoutIdle timeout; optional absolute cap30 minutes
Under the hood

What protects it

From the code
api/sso.pya rule, as the API takes it
class _AccessRulePayload(BaseModel):
    name: str
    description: str | None = None
    conditions: dict = Field(default_factory=dict)
    action: str = "mfa"  # allow | mfa | block | notify
    priority: int = 100
    is_active: bool | None = None

# example body
{"name": "Admins off-network", "action": "mfa",
 "priority": 10, "conditions": {
   "roles_any": ["admin"], "unknown_ip": true}}
Security notes
  • An address that cannot be resolved is treated as indeterminate, and refused under enforcement.
  • Locations are shown as approximate and are not used for decisions today.
  • Account locks and unlocks are sent as webhooks to subscribing apps.
  • Known-bad passwords are refused when people choose them on the console.
Works with

Part of one platform

CAPTCHA The bot check in front.Passkeys & MFA What "ask for MFA" asks for.Audit & SIEM export Every decision, exportable.
Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Make every sign-in harder to fake

Write your first rule, dry-run it, and switch it on when you trust it.

Book a demoStart free trial