---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Filter criteria

# Filter criteria {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Filter criteria (also called policy inputs) are used as inputs for policy conditions to
verify and meet the requirements of an authentication request.
Use filter criteria to supply information to authentication policies such as a user's IP address,
roles, or groups. Add these criteria in the Policy conditions section of
your policies.

There are seven types of filter criteria used in adaptive authentication. Your authentication policies can use one or more of these criteria to evaluate authentication requests.  
Note:  
Location filter and Identity Provider filter are available with Zero Trust Access feature. For more information, see [Zero Trust Access (ZTA)](https://www.servicenow.com/docs/zv3z7tRvQy_ZPy7UnfI~vA "Zero Trust Access (ZTA) is a security model in which no user or device is trusted by default.").
{#adaptive-auth-filter-criteria__table_dsr_zcz_2qb__entry__2}

| Type | Description |
|-|-|
| IP filter criteria | Use IP filter criteria to filter users based on the user's IP addresses. Both IPv4 and IPv6 are supported. |
| Role filter criteria | Use role filter criteria to filter users based on their roles. |
| Group filter criteria | Use group filter criteria to filter users based on the user group to which the user belongs. |
| Location filter criteria | Use location filter criteria to filter users based on the user location. |
| Identity Provider Attribute filter criteria | Use the Identity Provider attributes that are received from SAML response from the IdP as a filter criterion for authentication. |
[Table 1. Filter criteria types]

{#adaptive-auth-filter-criteria__table_dsr_zcz_2qb}

## Generic criteria {#adaptive-auth-filter-criteria__section_rv5_mzy_2qb}

In addition to the previously listed types, there are four generic filter criteria. These
criteria do not appear in your filter navigator, but you can select them while adding policy
inputs to your authentication policies.
{#adaptive-auth-filter-criteria__table_i43_tzy_2qb__entry__2}

| Type | Description |
|-|-|
| Authentication Scheme | Use to filter based on user's authentication scheme. This criterion is a choice type with two options: * User name and Password, which denotes a local login * SSO, which denotes a Multi-SSO (SAML, OIDC, or Digest) based login. {#adaptive-auth-filter-criteria__ul_op4_vzy_2qb} Note: This filter criterion is available only when the Integration - Multiple Provider Single Sign-On Installer plugin (com.snc.integration.sso.multi.installer) is installed. |
| Identity Provider | Use to filter based on the user's identity provider. Use along with the authentication scheme criteria to have granular control over login process. This criterion is a reference to the Identity Providers \[sso_properties\] table. Note: This filter criterion is available only when the Integration - Multiple Provider Single Sign-On Installer plugin (com.snc.integration.sso.multi.installer) is installed. |
| Role-based MFA | Use to filter based on the role-based MFA feature. This criterion is a boolean type filter criteria which denotes whether role-based MFA is enabled for the user.​ |
| User-based MFA | Use to filter based on the user-based MFA feature. This criterion is a boolean type filter criteria which denotes whether user-based MFA is enabled for the user.​ |
| Trusted mobile app | Trusted mobile app filter for enabling instance access from mobile app. |
[Table 2. Generic filter criteria types]

{#adaptive-auth-filter-criteria__table_i43_tzy_2qb}