---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Pre authentication context

# Pre authentication context {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Pre authentication context

The pre authentication policy context in ServiceNow defines how and when a policy is enforced during the login process, specifically executing before users see the login screen.
This context allows administrators to control access by permitting or denying entry before users enter login credentials based on predefined policies.
Show full answer Show less  

## Key Features

* **Execution Timing:** Policies run when a user first accesses the instance, before the login prompt appears.
* **Access Control:** Enables allowing or denying access based on IP filters, trusted mobile app filters, or location filters.
* **Policy Types:**
  * **Allow Policy:** Denies access to all users by default and only allows access if the policy conditions evaluate to true.
  * **Deny Policy:** Allows access by default and only denies access if the policy conditions evaluate to true.
* **Policy Conditions:** Only IP-based, location-based, or trusted mobile app filter criteria can be used. Other criteria, such as user roles or groups, are not applicable as the evaluation occurs before login.
* **Policy Configuration:** Inputs and conditions of the selected policy are visible in the context record for reference but must be edited in the policy record itself.
* **Error Handling:** Policies with non-absolute conditions or invalid filter criteria will trigger errors and cannot be configured. Proper validation of inputs is essential to prevent administrators from locking themselves out.

## Practical Considerations

* Ensure IP ranges and filter criteria match the administrator's session context to avoid accidental lockout.
* After upgrading to the Zurich release, verify the default policy settings due to changes related to Multi-factor Authentication enforcement.
* Because the policies operate before login, they cannot reference user-specific attributes like roles or groups.

## What to Expect

By configuring the pre authentication context, ServiceNow customers can enforce early access controls to their instances, enhancing security by blocking unauthorized access attempts before users reach the login screen. This setup helps protect the environment based on network location, trusted apps, or IP address, providing a first line of defense against unauthorized access.  
The pre authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes before your users see a login screen.

## Pre authentication context record {#pre-auth-context__section_rqw_y2r_2qb}

Policies in the pre authentication context execute when a user first accesses the instance, before they see a login screen.

You can use the pre authentication context to allow or deny access before your users are prompted for login credentials based on your selected policy. Because these policies evaluate before a user enters any information, those
policies can't take criteria such as a user's roles or groups into account.

Use the fields in the Pre Authentication policy context record to define how your instance uses your policy.  
{#pre-auth-context__table_otz_ngr_2qb__entry__2}

| Field | Description |
|-|-|
| Name | Name of the policy context. This field is static and can't be changed. |
| Description | Description of the context |
| Default Policy | Defines the default behavior of this context when evaluating the policy. Select from the following options. Allow Policy :   Denies access to all users by default, and only allows access when the conditions the policy selected in the Allow Policy field evaluate to true. Deny Policy :   Allows access to all users by default, and only denies access when the conditions the policy selected in the Deny Policy field evaluate to true. |
| Allow Policy | The policy used for this context uses. This field appears only when the Default Policy field is set to Allow Policy. |
| Deny Policy | The policy used for this context uses. This field appears only when the Default Policy field is set to Deny Policy. |
[Table 1. Pre Authentication context form]

{#pre-auth-context__table_otz_ngr_2qb}  
Note:  
Allow Policy denies access to all users by default. Deny Policy allows access to all users by default. After an upgrade to Zurich, check this field. See [Changes due to the Multi-factor Authentication enforcement](https://www.servicenow.com/docs/oerSmoZiJQ7zeOMge5SS8g "Information about the changes that are expected due to the MFA enforcement.").  
Note:  
You can only use the IP Filter, Trusted Mobile App Filter, and Location Filter criteria in the Pre Authentication Policy Context.

## Policy inputs and conditions {#pre-auth-context__section_uw4_vhr_2qb}

The Policy Input and Policy Conditions tabs display the inputs and conditions of the policy selected in the Allow Policy or Deny Policy
field. These tabs serve as a reference, but can't be used to change the policy inputs or conditions. To modify your policy, navigate to the policy using the reference icon (![Reference icon]()) next to the Allow Policy or Deny Policy field.  
This example shows a pre authentication policy context record configured to deny access by default. The context uses a policy called Deny access policy. That policy has a set of inputs and conditions that are displayed in the Policy Input and Policy Condition tabs.  
Note:  
* Only IP-Based filters, Location based filters, or Trusted Mobile App filter can be used in the pre authentication policy context.
* Whenever there's a pre authentication set with non absolute conditions or filter criteria, you're displayed with an error message stating that the policy or context can't be configured. It's recommended to validate all the inputs for the pre authentication context before executing it to the instance. For example: If the administrator is outside the trusted network and configures pre authentication context with IP ranges, if the IP
  ranges are mismatched with the current session of the admin, the admin is blocked.

{#pre-auth-context__ul_ufh_hdr_12c}
Figure 1. Pre authentication policy context form