---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# MFA enforcement exception

# MFA enforcement exception {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of MFA enforcement exception

This document explains how to relax Multi-Factor Authentication (MFA) enforcement in ServiceNow for specific users, roles, groups, trusted networks, and locations.
It also covers controlling frequent MFA prompts and considerations for shared accounts.
Show full answer Show less  

## Relaxing MFA Enforcement for Users, Roles, and Groups

* **Users:** In the Yokohama release, an *MFA Exempted User Group* allows exemption of specific users from MFA. Add users to this group via the MFA context's Step-Up MFA Policy configured to enforce MFA for non-SSO logins.
* **Roles:** A new filter criterion *Has MFA exempted role* lets you exempt users with specified roles from MFA. Add the roles to this criterion under the MFA context policy.
* **Groups:** Similar to users, groups can be exempted by adding them to the *MFA Exempted User Group*. Users in these groups bypass MFA enforcement.
* For custom policies, you can incorporate these filter criteria and adjust conditions accordingly.

## Relaxing MFA for Trusted Networks and Locations

* **Trusted Networks:** Define trusted IP ranges or subnets using *IP Filter Criteria* under Adaptive Authentication. Add these to the MFA policy inputs and modify conditions to bypass MFA for users connecting from these networks.
* **Trusted Locations:** Use the *Location Filter Criteria* available with the Zero Trust -- Location-Based Access plugin (requires additional subscription) to relax MFA based on geographic or location data.

## Controlling Frequent MFA Enforcement

* Enable the "remember browser" feature on the MFA validation page to reduce how often users must perform MFA on the same browser.
* Control the remembered browser duration using system properties like *glide.authenticate.multifactor.browser.fingerprint.validity* (default 8 hours, max 24 hours).
* Set the default state of the "remember browser" checkbox using *glide.authenticate.multifactor.remember.browser.default*.
* Adjust these properties in Multi-factor Authentication \> Properties to tailor user experience.

## Security Considerations for Shared Accounts

Sharing single user accounts across multiple users is a security risk and is not recommended, as it undermines MFA effectiveness.  
FAQ related to MFA enforcement exception and why it's important.

1. How can the MFA mandate be relaxed for specific users?In the Yokohama release, a new user group, MFA Exempted User Group record is added. Based on the default condition, there's an MFA policy added, any user who is a member of
   this group is enforced with MFA.

   To relax MFA for specific users, follow the procedure:
   * Navigate to MFA context. The Step-Up MFA Policy associated with the MFA context record should be "Enforce MFA for non-SSO logins.
   * Under the Policy Input related list, select the Is a member of MFA exempted group filter criteria record.
   * Select MFA Exempted User Group.
   * Add users to this group as a member to exempt them from MFA enforcement.

   {#faq-mfa-exception__ul_fbb_tl5_jdc}  
   Note:  
   If you have a different policy associated with the MFA context, you can add "Is a member of MFA exempted group" filter criteria to your policy and modify the policy conditions to exempt users of this group from MFA enforcement.
2. How can the MFAs mandate be relaxed for certain roles?In the Yokohama release, an empty new role Has MFA exempted role filter criterion is added. There are conditions added to the MFA policy to exempt users
   who have the roles part of exempted role criteria from the MFA enforcement.

   To relax MFA for specific roles, follow the procedure:
   * Navigate to MFA context. The Step-Up MFA Policy associated with the MFA context record should be Enforce MFA for non-SSO logins.
   * Under the Policy Input related list, select Has MFA exempted role filter criteria record.
   * Add the roles that you want to add to the condition. You can add multiple roles using the OR operator.

   {#faq-mfa-exception__ul_dcm_bm5_jdc}  
   Note:  
   If you have a different policy associated with the MFA context, you can add Has MFA exempted role filter criteria to your policy. Modify the policy conditions to exempt users with exempted roles from the MFA enforcement.
3. How can the MFAs mandate be relaxed for certain groups?In the Yokohama release, a user group MFA Exempted User Group is added. Based on the default, condition added to the MFA policy, the user or group who
   is a member of this group isn't enforced with MFA.

   To relax MFA for specific groups, follow the procedure:
   * Navigate to MFA context. The Step-Up MFA Policy associated with the MFA context record should be Enforce MFA for non-SSO logins.
   * Under the Policy Input related list, select the Is a member of MFA exempted group filter criteria record.
   * Select MFA Exempted User Group.
   * Add the groups that you want to exempt from the MFA enforcement to this group.
   {#faq-mfa-exception__ul_lyh_mm5_jdc}
4. How can the MFAs mandate be relaxed for trusted networks?  
   * Navigate to Adaptive AuthenticationFilter CriteriaIP Filter Criteria.
   * Create a criterion to specify a trusted network. You can specify a list of IP ranges or subnets as part of the trusted network.
   * Navigate to Adaptive AuthenticationAuth Policy ContextsMFA context.
   * Open the policy associated with the context.
   * Select the edit to add the IP Filter Criteria that you created to the Policy inputs-related list.
   * Modify the policy condition to confirm it evaluates to false when users are part of the trusted network.

   {#faq-mfa-exception__ul_ikb_sm5_jdc}  
   Note:  
   If you have a different policy associated with the MFA context, you can add the IP filter criteria created as part of Step 1 to your policy and modify the policy conditions to exempt MFA enforcement on the trusted network.
5. How can the MFAs mandate be relaxed for trusted locations?You can use Location Filter Criteria which is available with the Zero Trust -- Location Based Access (requires an additional subscription)
   plugin.

6. How to control the frequent MFA enforcement?Use the Location Filter Criteria which is available with the Zero Trust -- Location-Based Access (requires an additional subscription) plugin.

   On the MFA
   validation page, there's a check box to remember a browser. MFA isn't enforced on the remembered browser:
   * The duration specified by this system property. `glide.authenticate.multifactor.browser.fingerprint.validity`. The default value of the property is 8 hours. This duration can be increased by up to 24 hours. Similarly using the `glide.authenticate.multifactor.remember.browser.default` system property the default value of the check box can be set to true.
   * Navigate to Multi-factor AuthenticationProperties and adjust these four properties to control the remembered browser feature.
   {#faq-mfa-exception__ul_asq_2n5_jdc}
7. How does MFA work for accounts shared by users?Single accounts shared by multiple users are a security risk. It isn't recommended to share an account with multiple users.

{#faq-mfa-exception__ol_cgr_zfz_3dc}

*[\>]: and then