Introduction

Multifactor authentication helps increase your security posture within HelloID. It is configured using Portal Access Rules. This article will walk you through an example scenario in which the organization considers logins from the local network as safe, but wants other logins to face additional challenge.

Define the desired behavior

Consider the login options available to the organization. Are there multiple IdPs available? What are the work habits of your users? Is there a reasonable need for access off-site or off-hours?

Our example scenario will cover three access levels:

• General use
  A "normal" onsite user
• Sensitive access
  Onsite users who have access to privileged resources
• Offsite
  Anyone accessing HelloID from an uncontrolled environment

Implement the policies

Go to Security > Policies > Portal Access Rules and select the Add access rule button.

Configure the 'General use' example

Note: Before enabling this, or any other, access rule, double check the settings and ensure that administrative accounts will retain access after the application of the rule. Consider creating a "break-the-glass" local account for emergency use.

Configure the 'Sensitive access' example

Create a new policy with the above settings and these additions:

Learn more about available 2FA options.

Configure the 'Offsite' example

This policy is both a blend and an inversion of the previous two. Create a new policy and set these options:

Summary

We now have three unique portal access policies that improve security and provide accommodations for different access levels. By creating multiple portal access rules that allow or deny individual conditions and setting rule priorities, you can implement nearly any scenario needed.