# authentication-policy

Source: https://startwithidentity.com/glossary/authentication-policy/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

An authentication policy is an identity provider rule that decides which authentication methods a user must satisfy to reach a given application, based on conditions such as group membership, network location, device state and risk. It is where "require MFA" becomes specific: which factors count, for whom, for which app, and how recently.

Vendors name and scope it differently. In Okta Identity Engine, [app sign-in policies](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/about-app-sign-on-policies.htm) "define how a user must authenticate to gain access to an app" using conditions like group, IP zone and risk level. In [Microsoft Entra](https://startwithidentity.com/vendors/iam/microsoft-entra/), Conditional Access combines conditions with an [authentication strength](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths), which "specifies which combinations of authentication methods users can use to access a resource", for example only phishing-resistant methods for a sensitive app. The practical point from SWI's [Phishing-Resistant MFA Support Matrix 2026](https://startwithidentity.com/reports/phishing-resistant-mfa-matrix-2026/) is that 77 of 95 business SaaS apps (81.1%) offer SSO but cannot require phishing-resistant MFA themselves, so the IdP's authentication policy is the only place to enforce it. A policy that says "MFA required" without naming the method still lets an attacker pick the weakest factor the user has enrolled.

See also: [conditional access](https://startwithidentity.com/glossary/conditional-access/), [phishable MFA](https://startwithidentity.com/glossary/phishable-mfa/), [step-up authentication](https://startwithidentity.com/glossary/step-up-auth/), [SSO enforcement](https://startwithidentity.com/glossary/sso-enforcement/), [conditional access policies guide](https://startwithidentity.com/guides/implementation/conditional-access-policies-guide/), [MFA matrix](https://startwithidentity.com/tools/mfa-matrix/)