Manage user risk-based authentication settings

You can manage user-specific risk-based authentication settings. When you change these settings for a user, they override the system-wide settings configured in Modify risk-based authenticator general settings.

You can manage the following user risk-based settings:

• Location History

  When a user signs in to IDaaS, their sign-in location is added to the user's location history:

  • Authentication from a public location

    • IDaaS converts the IP address into location data and stores details such as country, city, latitude, longitude, ISP name, IP address, authentication date and time, and the number of authentications from that location.

    • For public locations, comparisons use country, city, and ISP. The IP address is also included if Check IP Address in Location History is enabled. If all comparison values match exactly, the locations are considered the same and the test passes. If there is any difference, even a minor ISP spelling variation, the test fails and risk points are added to the user's total risk score for that authentication attempt.

  • Authentication from a private location

    When a user signs in from a private location, IDaaS stores the IP address, authentication date and time, and the number of authentications from that location.

• Expected Locations

  • The Expected Locations list contains IP locations that users are expected to sign in from.
  • You can move a location from Location History to a user's Expected Locations list.

• Settings

  You can configure whether the user follows system-wide risk-based authentication settings or user-specific settings.

Manage expected locations

Use these steps to move location history to expected locations, add expected locations, and delete location history.

1. Click > Members > Users. The Users List page appears.
2. Click the User ID of the account that you want to edit. The User Details page appears.
3. Click the Risk-Based Authentication tab. The Risk-Based Authentication page appears.
4. Select Location History from the drop-down list. The Location History list appears.
5. To add a location history entry to Expected Locations, click next to the location.
6. In Add Expected Location, review the prepopulated fields, then click Save.
7. Repeat these steps to add additional expected locations.

Add or delete expected location

A user's personal expected locations list overrides the system-wide list when the two conflict. For example, if a user authenticates from a location that is not on the system-wide list but is on the user's personal list, the location is accepted.

Users do not have locations in their expected locations list unless an administrator assigns them.

1. Click > Members > Users. The Users List page appears.
2. Click the User ID of the account that you want to edit. The User Details page appears.
3. Click the Risk-Based Authentication tab. The Risk-Based Authentication page appears.
4. Select Expected Locations from the drop-down list. The Expected Locations list appears.
5. Click Add. The Add Expected Location page appears.
6. You must provide a value for at least one of these fields:
   • Select the Country from the drop-down list.
   • Enter a City Name.

• Enter the ISP (Internet Service Provider).
• Enter the IP Address. Click to resolve the IP address. The country, city name, and ISP are populated based on the IP address.

7. Click Save. The location is added to the user's Expected Locations list.

note

If you need to delete a location, click next to the location and then click Delete on the confirmation prompt.

Set user risk-based authentication settings

Complete these steps to configure user-level risk-based authentication settings:

1. Click > Members > Users. The Users List page appears.
2. Click the User ID of the account that you want to edit. The User Details page appears.
3. Click the Risk-Based Authentication tab. The Risk-Based Authentication page appears.
4. Select Settings from the drop-down list. The Settings dialog box appears.
5. Select Use System-Wide Settings or Use User-Specific Settings.
6. If you select Use User-Specific Settings, do the following:
   1. Set Maximum Number of Locations to the number of locations that can be included in the user's expected locations list.
   2. Select Check IP Address in Location History to compare the authentication request IP with the values in the user's Location History.
7. Select Check Travel Velocity to compare the distance between user authentication locations over a defined period.
8. Click Save.

Validate your changes

After you save, verify the following:

1. The user-specific settings are retained after page refresh.
2. Expected locations appear in the user's Expected Locations list.
3. If user-specific settings are enabled, those values override system-wide defaults for that user.