The Access policy regulates how VIP enforces access controls. By default, VIP enforces access by prompting users for multi-factor authentication when they sign in. This is the default setting for your account Access policy.

Note that users are always denied access if their request originates from a blacklisted country.

The Access policy cannot be changed at the account level; however, you can apply a different Access policy for individual user groups. Settings at the user group level overwrite the default policy settings for members of that user group.

When you add or edit a user group, you can set one of two levels of access:

Access Denied:

Users in this group are always denied access to any web resource protected by VIP.

Challenge with Multi-factor Authentication:

Users in this group are prompted for multi-factor authentication through VIP when they sign in. This is the default policy setting.

The Access policy defined at the group level always overwrites the default account policy. If a user belongs to more than one group with different Access policies, the user is assigned the stricter policy, in the order Access Denied > Challenge with MFA > Access Allowed.

Additionally, new users must always access the VIP Self Service Portal or My VIP portal to register a credential before the Access policy settings are applied to that user.

Access Policy settings are not supported for requests from VIP Enterprise Gateway 9.8.4 or earlier and are ignored.

See Adding a User Group or Editing the User Group Policies.