Skip to main content

Modify risk-based authenticator general settings

These settings control the system-wide risk-based authentication (RBA) restrictions applied to users of your IDaaS account. If a system-wide RBA setting conflicts with a user-specific RBA setting, the user-specific setting overrides the system-wide setting (see Manage user risk-based authentication settings).

The system-wide RBA settings contain default values. They can be modified as required.

Modify risk-based authenticator settings​

Complete these steps to update system-wide risk-based authenticator settings:

  1. Click > Policies > Risk-based Authentication. The Risk-based Authentication page appears.
  2. Click General and complete the following:
    1. Set Maximum Number of Locations to the number of most recent locations stored for users. These are stored in a user's account Location History. The minimum value is 0, which disables the location history feature. The maximum value is 10. The default value is 5.
    2. Set Location History Lifetime in Hours to the number of hours a location history entry is considered for comparison. The default value is 0. The maximum value is 100 years.
    3. Set Location History Trust Threshold to the number of times a user must log in from the same location before the location is trusted. The default value is 1. The maximum value is 100 times.
    4. Select Check IP Address in Location History to compare the authentication request IP address with values in Location History.
    5. Select Check Travel Velocity to compare the distance between locations from which a user has authenticated within a specific period of time.
    6. Set Maximum Travel Velocity to the maximum travel speed, in kilometers per hour (km/h), a user can travel between two authentication locations.

      This velocity is used during IP/Geolocation tests in authentication attempts. The default is 800 km/h, with a minimum of 100 km/h and a maximum of 1200 km/h.

    7. Set Maximum Number of Expected Locations to the maximum number of locations users in your account can sign in from without triggering a risk-based authentication failure.

      The default value is 10, the minimum value is 0, and the maximum value is 20. For more information, see Manage user risk-based authentication settings.

    8. Set Low-Medium Risk Threshold to the upper, non-inclusive value where a user's risk score is classified as medium instead of low.

      This setting defines the default threshold. You can customize the threshold for each SAML application through that application's resource rules. The default value is 21 points. The minimum value is 1 point, and the maximum value is 100 points.

    9. Set Medium-High Risk Threshold to the upper, non-inclusive value where a user's risk score is classified as high instead of medium.

      This setting defines the default threshold. You can customize the threshold for each SAML application through that application's resource rules. The default value is 51 points. The minimum value is 1 point, and the maximum value is 100 points.

  3. Click Save.
  4. Click Expected Locations and complete the following:
    1. Select Expected Locations from the drop-down list. The Expected Locations page appears.
    2. Click Add. The Add Expected Location page appears.
    3. You must provide a value for at least one of these fields:
      • Select the Country from the drop-down list.
      • Enter a City Name.
      • Enter the ISP (Internet Service Provider).
      • Enter the IP Address. Click to resolve the IP address. The country, city name, and ISP are populated based on the IP address.
    4. Click Save. You are returned to the Expected Locations page.
    5. Repeat these steps to add more expected locations.

Validate your changes​

After you save, verify the following:

  1. Updated values are retained in General settings.
  2. Risk thresholds reflect your intended policy boundaries.
  3. Added expected locations appear in the Expected Locations list.

Delete and filter expected locations​

If you need to delete any expected locations:

  • Click next to the location you want to delete.
  • Click Delete on the confirmation prompt.

If you want to filter for a country:

  • Click to enable filtering. The Filters dialog box appears.
  • Select your filter options and click Apply.