---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Authentication Console settings

# Authentication Console settings {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Settings on the Settings tab of the Authentication Console control whether the policy-based login experience is active and how the identifier-first login page behaves.

## Accessing the settings {#authentication-console-settings__access}

To view or change these settings, open the Authentication Console and select the
Settings tab. You need the `user_authn_admin`
role.  
Note:  
Some settings are SSO-related and require the Multi-Provider SSO plugin. When the plugin isn't installed, those settings are unavailable and a message on the Settings tab prompts you to install the plugin.

## Policy-based login experience {#authentication-console-settings__pble-group}

{#authentication-console-settings__pble-group__entry__3}

| Setting | Description | Default |
|-|-|-|
| Enable policy-based login (Recommended) | Enables the policy-based login experience on this instance to determine the first authentication factor during user login. | Off |
[ ]

## Identifier-first login settings {#authentication-console-settings__ifl-group}

{#authentication-console-settings__ifl-group__entry__3}

| Setting | Description | Default |
|-|-|-|
| Enable identifier-first login | When enabled, users see an identifier-first login flow that determines the authentication method based on configured policies. | On |
| Additional login options | When enabled, displays identity provider (IdP) tiles on the identifier-first login page. Instead of entering an identifier first, users can log in directly with a configured IdP. | Off |
| Recent identifiers | When enabled, displays previously used identifiers as clickable tiles on the identifier-first login page, so returning users can initiate login without re-entering their username or email. | On |
| Number of recent identifiers to display | Specifies how many recently used identifiers appear as tiles on the identifier-first login page. Helps returning users sign in faster, especially on shared devices. | 3 |
| SSO source-based IdP routing | When enabled, the identifier-first login functionality routes users to the IdP specified in the `sso_source` field. It checks the user record first; if no value is set, it falls back to the user's company record. Requires the Multi-Provider SSO plugin. | Off |
| IdP routing evaluation order | Determines whether SSO source-based IdP routing (`sso_source`) runs before or after identifier-first login policy evaluation. Requires the Multi-Provider SSO plugin. Choices: * Before policy evaluation --- Prioritizes explicit IdP assignments. * After policy evaluation --- Uses `sso_source` only as a fallback when no identifier-first login policy matches. | Before policy evaluation |
| Pre-fill identifier on the IdP login page | When enabled, the identifier entered on the login page is forwarded to the identity provider, so the IdP login page is pre-populated and the user doesn't have to re-enter it. | On |
[ ]

## Additional login settings {#authentication-console-settings__additional-group}

This setting is SSO-related and requires the Multi-Provider SSO plugin.
{#authentication-console-settings__additional-group__entry__3}

| Setting | Description | Default |
|-|-|-|
| Override cookie-based redirects | When enabled, policies are evaluated on every login, overriding any stored IdP cookie (`glide_sso_id`) from a previous login on this browser. | Off |
[ ]

## Debug settings {#authentication-console-settings__debug-group}

{#authentication-console-settings__debug-group__entry__3}

| Setting | Description | Default |
|-|-|-|
| Debug logs | When enabled, detailed logs for every login flow are captured, including policy evaluation, IdP routing decisions, and authentication outcomes. | Off |
[ ]