> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Modify risk-based authenticator general settings

These settings control the system-wide risk-based authentication (RBA) restrictions applied to users of your IDaaS account. If a system-wide RBA setting conflicts with a user-specific RBA setting, the user-specific setting overrides the system-wide setting (see [Manage user risk-based authentication settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/manage-user-risk-based-authenticator-settings.md)).

The system-wide RBA settings contain default values. They can be modified as required.

### Modify risk-based authenticator settings

Complete these steps to update system-wide risk-based authenticator settings:

1. Click Menu icon **>** **Policies > Risk-based Authentication**. The **Risk-based Authentication** page appears.

2. Click **General** and complete the following:

   1. Set **Maximum Number of Locations** to the number of most recent locations stored for users. These are stored in a user's account **Location History**. The minimum value is `0`, which disables the location history feature. The maximum value is `10`. The default value is `5`.

   2. Set **Location History Lifetime in Hours** to the number of hours a location history entry is considered for comparison. The default value is `0`. The maximum value is `100` years.

   3. Set **Location History Trust Threshold** to the number of times a user must log in from the same location before the location is trusted. The default value is `1`. The maximum value is `100` times.

   4. Select **Check IP Address in Location History** to compare the authentication request IP address with values in **Location History**.

   5. Select **Check Travel Velocity** to compare the distance between locations from which a user has authenticated within a specific period of time.

   6. Set **Maximum Travel Velocity** to the maximum travel speed, in kilometers per hour (`km/h`), a user can travel between two authentication locations.

      > This velocity is used during IP/Geolocation tests in authentication attempts. The default is `800` km/h, with a minimum of `100` km/h and a maximum of `1200` km/h.

   7. Set **Maximum Number of Expected Locations** to the maximum number of locations users in your account can sign in from without triggering a risk-based authentication failure.

      > The default value is `10`, the minimum value is `0`, and the maximum value is `20`. For more information, see [Manage user risk-based authentication settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/manage-user-risk-based-authenticator-settings.md).

   8. Set **Low-Medium Risk Threshold** to the upper, non-inclusive value where a user's risk score is classified as medium instead of low.

      > This setting defines the default threshold. You can customize the threshold for each SAML application through that application's resource rules. The default value is `21` points. The minimum value is `1` point, and the maximum value is `100` points.

   9. Set **Medium-High Risk Threshold** to the upper, non-inclusive value where a user's risk score is classified as high instead of medium.
      > This setting defines the default threshold. You can customize the threshold for each SAML application through that application's resource rules. The default value is `51` points. The minimum value is `1` point, and the maximum value is `100` points.

3. Click **Save**.

4. Click **Expected Locations** and complete the following:

   1. Select **Expected Locations** from the drop-down list. The **Expected Locations** page appears.
   2. Click **Add**. The **Add Expected Location** page appears.
   3. You must provide a value for at least one of these fields:
      - Select the **Country** from the drop-down list.
      - Enter a **City Name**.
      - Enter the **ISP** (Internet Service Provider).
      - Enter the **IP Address**. Click Search icon to resolve the IP address. The country, city name, and ISP are populated based on the IP address.
   4. Click **Save**. You are returned to the **Expected Locations** page.
   5. Repeat these steps to add more expected locations.

## Validate your changes

After you save, verify the following:

1. Updated values are retained in **General** settings.
2. Risk thresholds reflect your intended policy boundaries.
3. Added expected locations appear in the **Expected Locations** list.

### Delete and filter expected locations

If you need to delete any expected locations:

- Click Trash icon next to the location you want to delete.
- Click **Delete** on the confirmation prompt.

If you want to filter for a country:

- Click Search icon to enable filtering. The **Filters** dialog box appears.
- Select your filter options and click **Apply**.