Restrict login.do access method for "normal" users but not for admins

[Meloper]

We have activated Adaptive Authentication and currently all users from certain IP ranges can access our instance AND via the Now mobile app.

This question is about access from the permitted IP range via the browser.

The normal user connects to our instance via AZure MFA.
We want to prohibit login.do access for the normal user.The user should not be able to access the instance in any other way than via MFA.

Admins and audit users should still be able to use the login.do method.

Is that possible?

[Mark Manders]

If they all use SSO, except for the audit and admin users, you can just easily update the password of those users to a string of characters nobody knows. Login.do validates on the local password, while SSO validates through the Azure pw.

[Sohail Khilji]

HI @Meloper,

I believe login.do is a page which you can limit it based on role. if any users trying to access login.do it may not allow and may show access denied error.

I hope this helps...

[Mark Manders]

The page you are showing is a portal page and adding a role to it, will not make login.do unavailable (I just tested it). It will also be difficult to work, since the login.do page is showing the login screen before you are logged in, so the system doesn't know your roles yet. Only after validation it can do something and the question is about preventing people to login through login.do.