---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security
Release :
- yokohama
ft:locale :
- en-US
ft:publication_title :
- Yokohama Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Adaptive authentication
# Adaptive authentication {#ariaid-title1}
* Release version: Yokohama
*
* Updated January 30, 2025
*
*  2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Adaptive authentication
Adaptive authentication in ServiceNow Yokohama release enables enforcement of contextual authentication controls, allowing you to apply security policies dynamically based on user context.
It evaluates authentication requests using defined policies and either grants or denies access accordingly.
This framework helps restrict instance access for users and APIs by criteria such as IP address, user role, and user group, enhancing security by tailoring authentication requirements to specific conditions.
Show full answer Show less
## Key Features
* **Authentication Policies:** Define conditions to allow or deny access. For example, an Allow Access Policy might permit login only from trusted IP ranges and specific user roles.
* **Authentication Policy Contexts:** Specify when policies are enforced during login, either *pre-authentication* (before login screen) or *post-authentication* (after credentials submitted).
* **Filter Criteria:** Serve as inputs for policy conditions, providing data such as user role, IP range, or identity provider to evaluate access rules.
* **Authentication Properties:** Enable activation of adaptive authentication, debugging, and customization of user-facing messages when access is blocked.
* **REST API Access Policies:** Filter criteria can be applied to restrict inbound REST API access, securing programmatic integrations.
* **Domain Separation Support:** Policies operate at the domain level, with global domain policies affecting all domains in domain-separated instances.
* **Adaptive Authentication Events:** Track and review events related to adaptive authentication for monitoring and troubleshooting.
* **Custom Messaging:** Customize the language and content of messages shown to users upon authentication failure by updating sysuimessage records.
## Key Outcomes
By implementing adaptive authentication, ServiceNow customers can:
* Enhance security by enforcing context-aware access controls tailored to organizational policies.
* Reduce unauthorized access risks by restricting logins based on trusted parameters like IP addresses and user roles.
* Customize user experience with localized and clear messaging when access is denied.
* Control and monitor authentication processes and API access effectively, including in domain-separated environments.
Use the Adaptive authentication policy framework to enforce contextual authentication
controls to the right users at the right time. Adaptive authentication uses authentication
policies to evaluate authentication requests and then either deny or allow access to your instance
based on the specified policy conditions.
Use adaptive authentication policies and contexts to restrict the access to your instance for users and APIs based on criteria like IP address, user role, and user group. You can configure the built-in authentication policies
according to your security requirements.
For example, an administrator can configure the Allow Access Policy to allow logins from users only within a trusted range of IP addresses and who are members of a specific role. When assigned to the
Post-authentication context, the access policy denies access from untrusted IP addresses.
To set a custom message in the language of your instance you need to add key, value pair in sys_ui_message.list and update the sys_ui_message record. When you login with an incorrect
password, the custom message in the preferred language is displayed.
## Adaptive authentication components {#adaptive-authentication__section_yfj_2fz_qpb}
Authentication policies
: Authentication policies evaluate authentication requests based on the specified policy conditions and either allow or deny access depending on the output of policy conditions evaluation. For example, access is allowed
only if all the policy conditions specified in Allow Access Policy evaluate to true.
Authentication policies use information provided by filter criteria to compare against the policy's conditions to determine whether to grant access to the instance. For example, a filter criteria provides a user's IP
address, and a policy condition determines whether this address is within the specific range before granting access. Learn more about authentication policies in [Authentication policies](https://www.servicenow.com/docs/6L4P_~NgFNxWhEdCVQHomg "Authentication policies evaluate authentication requests based on the specified policy conditions and either allow or deny access depending on the output of policy conditions evaluation. For example, access is allowed only if all the policy conditions specified in Allow Access Policy evaluate to true.").
Authentication policy contexts
: Authentication policy contexts define how and when policies are enforced during the login process. The pre-authentication context executes before the user is shown a login screen. The post-authentication context executes
after the user enters their credentials. To use a policy, it must be assigned to a policy context. For details on these contexts, see [Authentication policy contexts](https://www.servicenow.com/docs/_jLdEOVUdCiW6JUEMWYo1Q "Use authentication policy contexts to determine how and when your instance enforces authentication policies.").
Filter Criteria
: Filter criteria (also called policy inputs) are used as inputs for policy conditions. Policy conditions use these inputs to verify and meet the requirements of authentication requests. These inputs provide information
like user role, IP range, and identity provider. For more detail on filter criteria, see [Filter criteria](https://www.servicenow.com/docs/ELkx7qVJCKj3b6VLrFIo7A "Filter criteria (also called policy inputs) are used as inputs for policy conditions to verify and meet the requirements of an authentication request.").
Authentication properties
: Use authentication properties to control whether adaptive authentication is active on your instance. You can also use properties to enabled debugging, and define the messaging users see when access is blocked. For details
on these properties, see [Configure adaptive authentication properties](https://www.servicenow.com/docs/zhEtAV0Vfj7G3HDTov08eA "After activating Adaptive Authentication, configure adaptive authentication properties according to your security requirements.").
## REST API access policies {#adaptive-authentication__section_qgj_fwy_v4b}
You can use the filter criteria of adaptive authentication framework to restrict access to inbound ServiceNow REST APIs. For more information, see [REST API access policies](https://www.servicenow.com/docs/5048wXRTIhZjmWIs3_g7hw "REST API access policies allow you to restrict access to inbound REST APIs based on the authentication type and the specified filter criteria of the access policy.").
## Domain separation and adaptive authentication {#adaptive-authentication__section_yxq_vrt_qpb}
Adaptive authentication is supported on domain separated instances on the authentication policy condition level. Policy conditions affect the domain in the records Domain \[sys_domain\] field. Policy
conditions in the global domain affect all domains.
## Adaptive Authentication Events {#adaptive-authentication__section_mrc_byj_zbc}
You can use the adaptive authentication events table to know about the events that have occurred specific to the adaptive authentication feature. For more information, see [Adaptive Authentication Events](https://www.servicenow.com/docs/Swpq0O4PVt4TebzlUokSsw "You can use the adaptive authentication events table to know about the events.").