--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Authentication policy contexts # Authentication policy contexts {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Authentication policy contexts Authentication policy contexts in ServiceNow determine how and when authentication policies are enforced during the login process. By assigning policies to specific contexts, you control access behavior before login, after login, during multi-factor authentication (MFA), and for account recovery and session validation activities. Show full answer Show less ## Authentication Policy Contexts * **Pre-authentication context:** Executes policies before users see the login screen. It can allow or deny access without user credentials but cannot evaluate user-specific criteria like roles or groups. * **Post-authentication context:** Executes after users submit credentials or single sign-on (SSO) responses, allowing policies to use user information to grant or deny access. * **MFA context:** Defines whether MFA is enforced during login, controlling the application of additional authentication factors based on policy configuration. * **Account recovery context:** Supports recovery tasks like fixing SSO misconfigurations or expired certificates. At least one administrator must be registered as an account recovery user before enabling SSO. * **Session Validation context:** Works with the Adaptive authentication policy framework to evaluate active sessions and grant or deny access based on policy conditions. ## Default Policy Behavior Within each policy context, you can set a **default policy** that governs how your instance responds when policies evaluate. The default options vary by context and include: * **Allow:** Access is allowed to all users by default unless denied by policy. * **Deny:** Access is denied to all users by default unless allowed by policy. Note that upgrades (such as to Zurich) can change the default policy settings for Pre or Post Authentication contexts. ## Practical Benefits for ServiceNow Customers Using authentication policy contexts enables granular control over access security, helping you enforce authentication steps precisely when needed---before login, after user identification, during MFA, or for session validation. This flexibility enhances your instance's security posture and ensures appropriate responses to authentication events, including recovery scenarios. Setting default policies helps maintain consistent access behavior aligned with your organization's security requirements. Use authentication policy contexts to determine how and when your instance enforces authentication policies. Authentication contexts define how and when a policy is enforced during the login process. Assign a policy to a policy context to define inputs and conditions regarding how your instance handles authentication. ## Pre-authentication context {#auth-policy-contexts__section_hhm_dqx_3pb} Policies in the pre-authorization context execute when a user first accesses the instance, before the they see a login screen. You can use the pre-authorization context to allow or deny access before your users are prompted for login credentials based on your selected policy. Because these policies evaluate before a user enters any information, those policies cannot take criteria such as a user's roles or groups into account. For more detail on this context, see [Pre authentication context](https://www.servicenow.com/docs/OZB0q6HyqAIT_Mk~3qIo4w "The pre authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes before your users see a login screen."). ## Post-authentication context {#auth-policy-contexts__section_gbq_fqx_3pb} Policies in the post-authorization context execute after your users enter their credentials or SSO response. Your instance allows or denies access based on your selected policy. Because your users have identified themselves via their login credentials, the policy can use user information to determine whether to grant access. For more detail on this context, see [Post-authentication context](https://www.servicenow.com/docs/bfcrTLpCJhTZDMiPW4JMZw "The Post Authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes after your users see a login screen."). ## MFA (Multi-Factor Authentication) context {#auth-policy-contexts__section_d4j_gqx_wpb} Policies assigned to the MFA context define whether to enforce MFA during the login process. Whether your instance enforces MFA is determined by the configuration of policies in this context. For more detail on this context, see [Multi-factor Authentication context](https://www.servicenow.com/docs/40oVoWMbQ4rAM06tPZojYg "The Multi-factor Authentication (MFA) policy context uses a policy to define how and when MFA is enforced during the login process."). ## Account recovery context {#auth-policy-contexts__section_vtz_xlx_jrb} Administrators can configure account recovery (ACR) to perform recovery activities such as addressing SSO misconfiguration or expired certificates. To use account recovery, you must register at least one admin account as an account recovery user. Single sign-on can't be activated on your instance until there is at least one account configured. For more information about the context that can be set, see [Account recovery context](https://www.servicenow.com/docs/ykM6PN7mccEnWxE2X0mLtw "The account recovery context uses a policy to define how and when the account recovery can be established."). ## Session Validation context {#auth-policy-contexts__section_z5q_jyw_mzb} The Session Validation context can be used with the Adaptive authentication policy framework. The framework uses authentication policies to evaluate authentication requests (session) and then either deny or allow access based on policy conditions. For more information, see [Session validation context](https://www.servicenow.com/docs/b4EhfBwPzYz65RGn59PkWQ "Use the Session Validation Context as an additional layer of protection against session or cookie hijacking."). ## Default policy {#auth-policy-contexts__section_k3y_cqx_3pb} Within the policy context, you can define a default policy in the Default Policy field. This default defines how your instance responds to the result of your policy. The available default policy options are determined by which context you are using. Detail on these options can be found in the docs describing these individual contexts. Allow Policy denies access to all users by default. Deny Policy allows access to all users by default. An upgrade to Zurich can change the default policy of a Pre or Post Authentication Policy Context. See [Changes due to the Multi-factor Authentication enforcement](https://www.servicenow.com/docs/oerSmoZiJQ7zeOMge5SS8g "Information about the changes that are expected due to the MFA enforcement.").