> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Manage user risk-based authentication settings

You can manage user-specific risk-based authentication settings. When you change these settings for a user, they override the system-wide settings configured in [Modify risk-based authenticator general settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/modify-risk-based-authenticator-settings.md).

You can manage the following user risk-based settings:

- **Location History**

  When a user signs in to IDaaS, their sign-in location is added to the user's location history:

  - Authentication from a **public** location

    - IDaaS converts the IP address into location data and stores details such as country, city, latitude, longitude, ISP name, IP address, authentication date and time, and the number of authentications from that location.

    - For public locations, comparisons use country, city, and ISP. The IP address is also included if **Check IP Address in Location History** is enabled. If all comparison values match exactly, the locations are considered the same and the test passes. If there is any difference, even a minor ISP spelling variation, the test fails and risk points are added to the user's total risk score for that authentication attempt.

  - Authentication from a **private** location

    When a user signs in from a private location, IDaaS stores the IP address, authentication date and time, and the number of authentications from that location.

- **Expected Locations**

  - The **Expected Locations** list contains IP locations that users are expected to sign in from.
  - You can move a location from **Location History** to a user's **Expected Locations** list.

- **Settings**

  You can configure whether the user follows system-wide risk-based authentication settings or user-specific settings.

## Manage expected locations

Use these steps to move location history to expected locations, add expected locations, and delete location history.

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.
2. Click the User ID of the account that you want to edit. The **User Details** page appears.
3. Click the **Risk-Based Authentication** tab. The **Risk-Based Authentication** page appears.
4. Select **Location History** from the drop-down list. The **Location History** list appears.
5. To add a location history entry to **Expected Locations**, click Map Pin Plus Inside icon next to the location.
6. In **Add Expected Location**, review the prepopulated fields, then click **Save**.
7. Repeat these steps to add additional expected locations.

## Add or delete expected location

A user's personal expected locations list overrides the system-wide list when the two conflict. For example, if a user authenticates from a location that is not on the system-wide list but is on the user's personal list, the location is accepted.

Users do not have locations in their expected locations list unless an administrator assigns them.

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.
2. Click the User ID of the account that you want to edit. The **User Details** page appears.
3. Click the **Risk-Based Authentication** tab. The **Risk-Based Authentication** page appears.
4. Select **Expected Locations** from the drop-down list. The Expected Locations list appears.
5. Click **Add**. The **Add Expected Location** page appears.
6. You must provide a value for at least one of these fields:
   - Select the **Country** from the drop-down list.
   - Enter a **City Name**.

- Enter the **ISP** (Internet Service Provider).
- Enter the **IP Address**. Click Search icon to resolve the IP address. The country, city name, and ISP are populated based on the IP address.

7. Click **Save**. The location is added to the user's **Expected Locations** list.

note

If you need to delete a location, click Trash icon next to the location and then click **Delete** on the confirmation prompt.

## Set user risk-based authentication settings

Complete these steps to configure user-level risk-based authentication settings:

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.
2. Click the User ID of the account that you want to edit. The **User Details** page appears.
3. Click the **Risk-Based Authentication** tab. The **Risk-Based Authentication** page appears.
4. Select **Settings** from the drop-down list. The **Settings** dialog box appears.
5. Select **Use System-Wide Settings** or **Use User-Specific Settings**.
6. If you select **Use User-Specific Settings**, do the following:
   1. Set **Maximum Number of Locations** to the number of locations that can be included in the user's expected locations list.
   2. Select **Check IP Address in Location History** to compare the authentication request IP with the values in the user's **Location History**.
7. Select **Check Travel Velocity** to compare the distance between user authentication locations over a defined period.
8. Click **Save**.

### Validate your changes

After you save, verify the following:

1. The user-specific settings are retained after page refresh.
2. Expected locations appear in the user's **Expected Locations** list.
3. If user-specific settings are enabled, those values override system-wide defaults for that user.