> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Modify knowledge-based authenticator settings

Knowledge-based authentication (KBA) allows a user to authenticate to an application account using IDaaS. There are three parts to setting up knowledge-based authentication:

1. Customize the [General settings](#modify-general-knowledge-based-authenticator-settings) (as described below)
2. [Create and manage questions for users](/docs/authentication-and-security/manage-authenticators/manage-knowledge-based-authenticators-kba/create-and-manage-kba-questions.md)
3. [Create Word Maps](/docs/authentication-and-security/manage-authenticators/manage-knowledge-based-authenticators-kba/create-word-maps.md)

Complete the following steps, as required to customize knowledge-based authentication for your users.

Before you update these settings, make sure enough question and answer pairs are available for your users. Challenge and wrong-answer settings work best when users have enough enrolled questions.

### Modify general knowledge-based authenticator settings

1. Click Menu icon **>** **Policies** **>Authenticators**.

2. Select **Knowledge-Based Authenticator**. The **Knowledge-Based Authenticator** page appears.

3. Set the **Maximum Number of Q&A Pairs** (the maximum number of paired questions and answers IDaaS stores for a user). A setting of `0` disables knowledge-based authentication.

4. Set the **Maximum Response Size** to the number of characters a response can contain, to a maximum of 255.

5. Set the **Default Q&A Challenge Size** to the default number of questions the application presents to users during a KBA challenge.

note
The **Knowledge-based Authentication** settings of a resource rule can override this value. If so, the value entered in the resource rule must be greater-than or equal to the **Minimum Q&A Challenge Size** and less-than or equal to the **Maximum Q&A Challenge Size.**

6. Set the **Minimum Q&A Challenge Size** to the minimum number of questions presented to users during a KBA challenge.

   > The number must be greater than `0` and less than or equal to the number set in the **Default Q&A Challenge Size**.

7. Set the **Maximum Q&A Challenge Size** to the maximum number of questions presented to users during a KBA challenge.
   > The number must be greater than or equal to the number set in the **Default Q&A Challenge Size** setting.

note
Setting **Maximum Q&A Challenge Size** to a value greater than **Minimum Q&A Challenge Size** allows you to modify a resource rule **Q&A Challenge Size.**

8. Do one of the following:

   1. Select **Disable Challenge Retention** to replace the challenge (namely, the set of questions) each time a challenge is requested.

      > Users who answer a challenge incorrectly will have a new challenge presented to them for the next attempt.

   2. Deselect **Disable Challenge Retention** if you want to retain the challenge for the duration of the **Q&A Challenge Lifetime**.
      > Users who answer a challenge incorrectly will have the same challenge presented to them for all subsequent attempts until they are locked out or until the challenge lifetime is exceeded. After the challenge lifetime is exceeded, a new challenge is presented.

9. Set the **Q&A Challenge Lifetime in Seconds** to the set number of seconds the user has to respond to the KBA challenge. If a user fails to respond within the lifetime, a new set of questions appears.

10. Select **Update Lockout Count for Replaced Challenge** if you want to increase the lockout count when a Q&A challenge is replaced because:

    - A user does not answer a question within the Q&A challenge lifetime.
    - A user restarts the client application without answering the question.

note
The lockout count always increases when a user enters an incorrect challenge response, regardless of how this setting is configured.

11. Set the **Default Number of Wrong Answers Allowed** to less than or equal the **Maximum Number of Wrong Answers Allowed**. A value of `0` means that no wrong answers are allowed.

note
A resource rule can override this value. If so, the value entered in the resource rule must be less-than or equal to the **Maximum Number of Wrong Answers Allowed** and less-than **Q&A Minimum Challenge Size** of the resource rule.

12. Set the **Maximum Number of Wrong Answers Allowed** to define the upper limit that a resource rule can set for wrong answers.

    > The value must be less than the number of questions presented, and greater than or equal to the **Default Number of Wrong Answers Allowed** setting. A value of `0` means that all questions must be answered correctly.

13. Select **Inexact Match Allowed for an Answer** to allow a user to enter an answer that is not an exact match but matches one of the variations included in the word map file.

14. Click **Save**.

## Validate your changes

After you save, verify the following:

1. Users receive the expected number of questions during a challenge.
2. Challenge retention behavior matches your policy when users retry.
3. Wrong-answer limits are enforced as expected.
4. Inexact matching works only when corresponding word map variations exist.