---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Create an IFL policy for SSO authentication

# Create an identifier-first login policy for SSO authentication {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create an identifier-first login policy that routes matching users to a single
sign-on (SSO) identity provider.

## Before you begin

Role required: `user_authn_admin`

The SSO login authentication method is available only when the Multi-Provider SSO plugin is
installed and at least one identity provider is configured. Until then, the SSO login option
is unavailable and you can select only Use Password. To route users to password
authentication instead, see [Create an identifier-first login policy for password authentication](https://www.servicenow.com/docs/xygA2Mc5fBXNKYcIdbXdiw "Create an identifier-first login policy that routes matching users to password-based authentication (a username and password managed within the platform).").

## About this task

An SSO-based identifier-first login policy routes matching users to an organization identity provider, so they
log in using their existing SSO credentials.

## Procedure

1. Navigate to AllAuthentication Console.
2. In the Authentication Console, open the Policies tab and select the option to create a policy.
3. Under Policy Details, enter a Name (required) and, optionally, a Description.
4. Under Authentication Method, select SSO login.
5. In Select an Identity Provider, choose the identity provider to route matching users to.
6. Under Conditions, specify the conditions that determine when the policy applies.
   1. Select a Field and an Operator, and enter a value.
   2. To combine conditions, use or and and, or select Add condition set to add another set of conditions.
7. Under Policy evaluation, select Active to apply the policy during login, and enter a numeric Policy order value.  
   Only active policies are evaluated. Policies are evaluated by order value, and lower
   values are executed first.
8. Select Create Policy.
{#create-ifl-policy-sso__steps}

## Result

The policy appears on the Policies tab. When active, matching users are routed to the
selected identity provider during the identifier-first login flow.

*[\>]: and then