---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Authentication Console

# Authentication Console {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Authentication Console

The Authentication Console in ServiceNow provides administrators a centralized, no-code interface to configure and manage authentication behaviors across their instance.
It simplifies setting up and controlling login experiences, including identifier-first login (IFL) policies, without requiring custom development.
Access to the console requires theuserauthnadminrole and is found underAll \> Authentication \> Authentication Console.
Show full answer Show less  

## Key Features

* **Identifier-First Login (IFL) Policies:** Administrators can enable or disable IFL for the instance, create and manage multiple IFL policies, and define detailed conditions (such as IP address, roles, groups, company, domain, and location) using a guided condition builder.
* **Policy Configuration:** Each IFL policy can be assigned an authentication method---either a Single Sign-On (SSO) provider or local login---and administrators can set the evaluation order to prioritize policies when multiple conditions apply.
* **SSO Cookie Override:** Configure behavior to either honor or bypass stored SSO session cookies during login routing, enhancing control over session management.
* **Instance-Level Settings:** Toggle key login experience features, including enabling policy-based login, identifier-first flow, identity provider tiles, and recently used identifiers. Some routing options require the Multi-Provider SSO plugin.
* **Diagnostic Tools:** Access detailed login-flow debug logging to troubleshoot authentication processes.

## Access and Role Requirements

Only users with the **userauthnadmin** role can access the Authentication Console. They can perform operations such as:

* Viewing, creating, editing, activating, deactivating, and deleting IFL policies.
* Managing instance-level authentication settings, including enabling the next-generation login experience and configuring SSO cookie override.

## Practical Benefits for ServiceNow Customers

By using the Authentication Console, ServiceNow administrators can efficiently configure secure and flexible authentication methods tailored to user conditions without custom coding. This centralized control streamlines login policy management, improves security posture through precise policy assignments, and enhances user experience with configurable login flows and SSO session handling.  
The Authentication Console enables administrators to configure and manage authentication behavior across a ServiceNow instance, including identifier-first login policies and related settings.
The Authentication Console provides a centralized location for administrators to configure how users authenticate with a ServiceNow instance. The console ease presents authentication settings in a structured interface designed for administrators without requiring custom development.

The console is accessible to users with the `user_authn_admin` role. Navigate to AllAuthenticationAuthentication Console to open it.

## What the Authentication Console includes {#authentication-console__auth-console-capabilities}

The Authentication Console currently includes configuration for the next-generation login experience. Additional authentication configuration areas may be added in future releases.

Identifier-first login (IFL) policies

:   The Authentication Console enables administrators to configure identifier-first login (IFL) for the instance. From this section, administrators can:

    * Enable or disable the identifier-first login flow for the instance.
    * View the list of all IFL policies configured on the instance.
    * Create, edit, activate, deactivate, and delete IFL policies.
    * Define conditions for each policy --- such as IP address, role, group, department, company, domain, and location --- using a guided condition builder.
    * Assign an authentication method to each policy --- either an SSO provider or local login.
    * Set and adjust the evaluation order of policies to control which policy takes precedence when multiple policies match a user.
    * Configure SSO cookie override behavior to control whether a previously stored SSO session cookie is honored or bypassed during login routing.
    {#authentication-console__ul_t4x_mp2_pjc}

Settings
:   Contains instance-level toggles for the login experience, including the option to enable the identifier-first login flow and configure SSO cookie override behavior.
:
    * Enable policy-based login --- the main setting that turns the experience on and determines the first authentication factor during login. See [Activate the policy-based login experience](https://www.servicenow.com/docs/Si3sc37mZXa~NGw~6RWhMw "Activate the policy-based login experience so that you can create and manage the identifier-first login (IFL) policies that drive the next-generation login experience.").
    * Identifier-first page options, such as showing identity provider tiles for direct login and showing recently used identifiers.
    * SSO and identity provider routing options, which require the Multi-Provider SSO plugin. Without the plugin, these options are unavailable.
    * Diagnostic options, such as detailed login-flow debug logging.

## Access and role requirements {#authentication-console__auth-console-access}

Access to the Authentication Console is restricted to users with the `user_authn_admin` role. The following operations are available to users with this role:
{#authentication-console__table_u4x_mp2_pjc__entry__2}

| Operation | Description |
|-|-|
| View IFL policies | View the list of all IFL policies and their current configuration. |
| Create IFL policies | Create IFL policies with conditions and an authentication method. |
| Edit IFL policies | Modify the name, order, conditions, authentication method, or active status of an existing IFL policy. |
| Activate or deactivate IFL policies | Include or exclude a policy from login evaluation without deleting it. |
| Delete IFL policies | Permanently remove an IFL policy from the instance. |
| Manage instance settings | Enable or disable the next-generation login experience and configure SSO cookie override behavior. |
[ ]

{#authentication-console__table_u4x_mp2_pjc}

*[\>]: and then