> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Manage group policies

Group policies let you override global settings for specific groups of users. When you create a group policy and change a setting, the change applies only to the users in the group assigned to that group policy.

## Example use cases

Use group policies when different user populations need different security, registration, or authenticator settings. Common examples include the following:

- **Privileged administrators.** Require higher-assurance [Passkey/FIDO2](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators/modify-passkey-fido2-authenticator-settings.md) settings for IDaaS administrators, such as user verification, device-bound passkeys, or approved authenticator models, while allowing broader compatibility settings for lower-risk users.
- **Different password policies.** Set different [password authenticator](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators/modify-password-authenticator-settings.md) requirements for groups that require different assurance levels, such as longer passwords, stricter password rules, or shorter password lifetime for privileged users.
- **Employees and contractors.** Set different [registration](/docs/people-and-access/manage-user-policies/configure-user-registration.md) requirements so employees must register a standard set of authenticators, while contractors register only the authenticators required for their access.
- **Privileged self-service users.** Require stronger [verification](/docs/people-and-access/manage-user-policies/configure-user-verification.md) or authentication levels before users in privileged groups can manage authenticators or recovery options.
- **Consumer or lower-risk users.** Allow broader authenticator compatibility, such as more flexible Passkey/FIDO2 settings, while preserving stricter settings for workforce, administrator, or regulated user groups.

## Group policy hierarchy

If more than one group policy applies to the same setting, Identity as a Service uses the policy with the highest priority. For example, if one OTP policy applies only to Group A and has a higher priority than another policy that applies to Groups A and B, the higher-priority policy takes effect for Group A. You can change policy priority by dragging policies into a new order on the **Group Policies** page.

info

Before you begin, you must create the required groups. See [Create and manage groups](/docs/people-and-access/manage-members/create-and-manage-groups.md), [Import groups](/docs/perform-bulk-operations/bulk-import-operations/import-groups.md), and [Import users and groups](/docs/perform-bulk-operations/bulk-import-operations/import-users-and-groups.md).

## Group policy override options

Using group policies, you can override the global settings for the following:

- General authenticator settings
- Authenticators
- User Portal available authenticators
- Authenticator Provisioning
- Registration
- Verification
- Risk-based authentication

### Add group policies

Follow these steps to add group policies.

1. Click Menu icon **>** **Policies** **> Group Policies**. The **Group Policies** page appears.

2. Click Circle Plus icon. The **Add Group Policy** page appears.

note
Click Play icon to view the overrides to the global policies.

3. Select **Enabled** to apply the group policy to the selected groups.

4. Enter a **Name** for the group.

5. Select the **Group** from the drop-down list.

note
You can select Active Directory (AD) groups for a group policy. However, IDaaS disables the policy if the AD group is the only group assigned to the policy and that group is deleted from Active Directory and later removed from Identity as a Service during AD synchronization.

6. To add more groups, repeat the previous step. If you want to remove a group from the group policy, click Circle X icon next to the group.

7. To add overrides to the group policy, in the **Settings Category** click **Add**.

8. From the **Settings** drop-down list, select the **Setting** or **Authenticator** you want to override for the group. The global settings for your selection appear.

9. Change the required global settings for the group policy.

10. Click **Save** to save the changes to override the global settings and apply new settings to the group or groups only.

11. To add another **Settings Category**:

    1. Click **Add** again.
    2. Select the **Settings** from the drop-down list.
    3. Using the links provided in the [Settings categories](#settings-categories) section for help, make the required changes.
    4. Click **Save**.

## Settings categories

The following settings and authenticator categories can be overridden in a group policy.

### Settings categories

- [Authenticator Provisioning](/docs/people-and-access/manage-user-policies/configure-authenticator-provisioning.md)
- [General](/docs/authentication-and-security/manage-authenticators/manage-general-settings.md)
- [Registration](/docs/people-and-access/manage-user-policies/configure-user-registration.md)
- [Risk-based authentication](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings.md)
- [User portal](/docs/user-portal-settings.md)
- [Verification](/docs/people-and-access/manage-user-policies/configure-user-verification.md) (available only with the Consumer and Premium bundles)
- [User Notifications](/docs/notifications-and-email/manage-notifications/manage-user-notifications.md)

### Authenticator settings categories

- [Legacy Token](/docs/authentication-and-security/manage-authenticators/manage-hardware-tokens/modify-legacy-token-settings.md)
- [Entrust Soft Token](/docs/authentication-and-security/manage-authenticators/manage-soft-token-authenticators/modify-entrust-st-authenticator-settings.md)
- [Passkey/FIDO2](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators/modify-passkey-fido2-authenticator-settings.md)
- [Google Authenticator](/docs/authentication-and-security/manage-authenticators/manage-soft-token-authenticators/modify-google-authenticator-settings.md)
- [Grid Card](/docs/authentication-and-security/manage-authenticators/manage-grid-cards/modify-grid-card-authenticator-settings.md)
- [Hardware Token](/docs/authentication-and-security/manage-authenticators/manage-hardware-tokens/modify-hardware-token-settings.md)
- [Knowledge-based Authenticator](/docs/authentication-and-security/manage-authenticators/manage-knowledge-based-authenticators-kba/modify-kba-settings.md)
- [Temporary Access Code](/docs/authentication-and-security/manage-authenticators/manage-temporary-access-codes/modify-temporary-access-codes.md)

### Administrator role

When you select this option, the selected role is dynamically applied to users in the group. The group policy applies the role only to users who do not already have a predefined role.

For example, if the group policy assigns the Auditor role to users in GroupA:

- User1 is in GroupA but already has the Help Desk Administrator role, so the group policy does not change User1's role.
- User2 is in GroupA and has no role assigned, so the group policy dynamically assigns User2 the Auditor role.

See [Add users](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/add-users.md) for more information on user settings.

### Tenant

Available only to Service Providers.

### Manage group policies

When you have finished adding your overrides to the group policy, you can manage them as follows:

1. Click Menu icon **>** **Policies** **> Group Policies** **to return to the** **Group Policies** page. The group policies appear on this page.
2. Do the following as required:
   - Toggle to enable or disable a group policy.
   - Click Menu icon to drag and drop to reorder the group policy priority order.
   - Click Trash icon next to the group policy to delete it.