# risk-based-auth

Source: https://startwithidentity.com/glossary/risk-based-auth/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Risk-based authentication (RBA) adjusts authentication requirements based on signals such as device, location, network, and behavior. Low-risk sessions pass smoothly while risky ones face a step-up challenge such as MFA.

The point is to reduce friction without weakening security: a login from a known device and usual location proceeds, while an unfamiliar device, an impossible-travel pattern, or an anomalous action triggers an additional factor. RBA is the engine behind [adaptive authentication](https://startwithidentity.com/glossary/adaptive-auth/) and a core building block of [conditional access](https://startwithidentity.com/glossary/conditional-access/) and [zero trust](https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/). For platforms that implement it, see the [top risk-based authentication platforms](https://startwithidentity.com/articles/top-5-risk-based-authentication-platforms/).

RBA is the mechanism behind most consumer MFA that users tolerate, since the challenge only appears when something looks unusual. The honest limitation is signal quality: residential proxies, real browsers, and stolen sessions all look normal, so a low risk score can mean either a legitimate user or a good attacker. Use it to decide when to demand a strong factor, not whether to have one.

See also: [adaptive auth](https://startwithidentity.com/glossary/adaptive-auth/), [step-up auth](https://startwithidentity.com/glossary/step-up-auth/), [conditional access](https://startwithidentity.com/glossary/conditional-access/), [UEBA](https://startwithidentity.com/glossary/ueba/)