---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Technical reference

# Policy-based login experience technical reference {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
System properties, affected login routes, policy conditions, authentication methods,
and fallback behavior for the policy-based login experience.

## System properties {#ngle-technical-reference__properties}

{#ngle-technical-reference__properties__entry__3}

| Property | Description | Default |
|-|-|-|
| Enable policy-based login `glide.authenticate.policy_based_login_experience.enabled` | Enables the policy-based login experience. The identifier-first login flow takes effect when this property is enabled and at least one active identifier-first login policy exists. | false |
[ ]

## Affected login routes {#ngle-technical-reference__routes}

Traditional login pages, such as `login.do` and `oauth_login.do`, remain functional and aren't affected.  
Note:  
Enabling the identifier-first login flow for the ServiceNow AI Platform login page does not affect Service Portal login unless the portal is explicitly configured to use it. To know more, see [Enable identifier-first login in Service Portal](https://www.servicenow.com/docs/access?context=identifier-first-login-service-portal&version=brazil&pubname=brazil-platform-user-interface&ft:locale=en-US).

## Policy conditions {#ngle-technical-reference__conditions}

Identifier-first login policies support the following user-context conditions. When a policy has multiple
conditions, all conditions must be met for the policy to match.

* IP address
* Role
* Group

## Fallback sequence {#ngle-technical-reference__fallback}

If no identifier-first login policy matches, the instance applies the default routing in this order:

1. Default SSO routing, using the user's SSO source or the default identity provider (IdP).
2. If no IdP applies, the local login page.

If the instance can't identify the user from the entered identifier, it follows the auto-provisioning routing: if a single IdP supports auto-provisioning, the user is routed to that IdP; if multiple IdPs apply, an IdP selection
page is shown; if none apply, the password page is shown to avoid revealing whether the user exists.