Authentication Policy
An authentication policy is an identity provider rule that decides which authentication methods a user must satisfy to reach a given application, based on conditions such as group membership, network location, device state and risk. It is where "require MFA" becomes specific: which factors count, for whom, for which app, and how recently.
Vendors name and scope it differently. In Okta Identity Engine, app sign-in policies "define how a user must authenticate to gain access to an app" using conditions like group, IP zone and risk level. In Microsoft Entra, Conditional Access combines conditions with an authentication strength, which "specifies which combinations of authentication methods users can use to access a resource", for example only phishing-resistant methods for a sensitive app. The practical point from SWI's Phishing-Resistant MFA Support Matrix 2026 is that 77 of 95 business SaaS apps (81.1%) offer SSO but cannot require phishing-resistant MFA themselves, so the IdP's authentication policy is the only place to enforce it. A policy that says "MFA required" without naming the method still lets an attacker pick the weakest factor the user has enrolled.
See also: conditional access, phishable MFA, step-up authentication, SSO enforcement, conditional access policies guide, MFA matrix
Related on Start with Identity
- GlossaryLocal Login Bypass
A local login bypass is any way into an SSO-protected application that does not go through the identity provider: an owner or admin account that keeps a passwor
- GlossarySSO Tax
The SSO tax is the practice of offering single sign-on (SAML or OIDC) only on a higher-priced plan, an enterprise plan or a paid add-on, so that a customer must
- GlossaryAdaptive Authentication
Authentication flows that change based on risk signals. Low-risk sign-ins may complete with one factor; high-risk sign-ins escalate to step-up MFA or are blocke
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- BlogA 9.8-CVSS vCenter authentication bypass has no workaround, only an emergency patch
Broadcom shipped emergency fixes for three critical VMware flaws, including CVE-2026-59309 (CVSS 9.8), which lets any attacker with network access to vCenter by
- GuideAuthentication vs Authorization: The Difference That Trips Everyone Up
Authentication and authorization sound alike and are often shortened to the same "authZ/authN," but they answer different questions. Getting them straight is fo