Skip to main content

Policy FAQ

I don't want to write every policy by hand. How do I start quickly?​

Put the tenant in Audit mode. AuthNull records sign-ins and creates policies from them; review those, then move to Policy and Live mode. See Policy Modes.

How do I protect VPN and network device logins?​

Switch to the RADIUS product and create a policy under Policies for the users and network devices, with the action MFA Required. Users then sign in to the device with their directory account and approve a push. A login that no RADIUS policy covers is allowed through. See RADIUS MFA.

Is MFA always on?​

No - it depends on the policy's action. A sign-in requires a push only when the matching policy's action requires MFA (MFA required, Require MFA, or Require approval, depending on the product). PAM policies require approval by default.

How do I give someone access - for example to a database, or a privileged account on a server?​

Create a policy in that product's Policies screen. AuthNull does not hand out passwords: the user signs in with their own identity, approves a push if the policy requires it, and AuthNull brokers the access.

Can a policy grant admin rights on a server?​

Yes, in PAM: a policy can grant full sudo or specific commands for 5 to 720 minutes, only to sessions approved with MFA. See Sudo in Policies.