---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# IFL policies

# Identifier-first login policies {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Identifier-first login is the framework the policy-based login experience currently uses. Identifier-first login policies, evaluated through the policy-based login experience, determine how the instance routes a user to an authentication
method after the user enters an identifier.

## Identifier-first login policies for ServiceNow AI Platform {#ifl-policies__section_lns_zj5_kkc}

An identifier-first login policy controls how login is determined. After a user enters an identifier, the instance evaluates the active identifier-first login policies and uses the first matching policy to determine which login method is prompted to the user, based on the policy conditions. The login method is either SSO login or Use Password --- for example, to a specific
SSO provider or to password-based authentication.

Identifier-first login policies are part of the policy-based login experience (PBLE). For identifier-first login to work, PBLE must be enabled with the glide.authenticate.policy_based_login_experience.enabled system property, and at least one identifier-first login policy must be active.

## Identifier-first login policies for Service Portal {#ifl-policies__section_o32_2k5_kkc}

When a user signs in through a Service Portal, the Service Portal uses an identifier-first login authentication method where the authentication path is determined by the username or email entered. The path is evaluated
against configured identifier-first login policies. Identifier-first login takes precedence over any identity provider or local login options configured for the portal. To know more, see [Enable identifier-first login in Service Portal](https://www.servicenow.com/docs/access?context=identifier-first-login-service-portal&version=brazil&pubname=brazil-platform-user-interface&ft:locale=en-US).

## Identifier-first login policies for Now Mobile {#ifl-policies__section_bvb_fk5_kkc}

When a user signs in through the Now Mobile app, the identifier-first login flow evaluates the same active identifier-first login policies and routes the user to the resulting authentication method. The policies, conditions, and evaluation order are the same as for
browser-based logins; the app presents the identifier-first login page and the routed authentication method within the mobile sign-in experience.

Identifier-first login for the Now Mobile app is opt-in. To turn it on, enter <kbd class="ph userinput">ifl_login.do</kbd> as the Login URL in the corresponding OAuth entity record.  
Note:  
If Force local login is enabled for the mobile app, identifier-first login behavior at login isn't effective in mobile authentication. For more information about force local login, see [KB1560809](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1560809).

## Components of an identifier-first login policy {#ifl-policies__components}

Each identifier-first login policy defines:

* Policy order: the order in which the policy is evaluated. Lower values are evaluated first.
* Conditions: the conditions that determine when the policy applies.
* Authentication method: SSO login or Use Password, the login method prompted to the user.
* Policy status: only active policies are evaluated.

{#ifl-policies__ul_jyk_fkf_fkc}

For how policies are evaluated, see [Policy evaluation order](https://www.servicenow.com/docs/2HikQKa2Kfo3YIfNc4zE8A "The instance evaluates identifier-first login policies in order and applies the first policy whose conditions match the user.").