---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Tutorial: Configure adaptive authentication

# Tutorial: Configure adaptive authentication {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Use these example steps to configure adaptive authentication on an instance.

To use this tutorial, you must have an instance with Adaptive Authentication
activated. For details on this process, see [Activate adaptive authentication](https://www.servicenow.com/docs/MgYYkSaKlnN0Y2xSeHTspQ "You can activate the Adaptive Authentication plugin (com.snc.adaptive_authentication) for Adaptive Authentication if you have the admin role.").  
The example guides you through creating a new policy and applying it to an instance. In this tutorial you will:

Create a filter criteria record
:   Create a group filter criteria record to use as an input for your policy. This record allows your policy to determine access based on a user's group. In these steps you define the group or groups the policy uses to
    determine access.

Create a policy
:   Create a policy that determines whether a user can access the instance. This policy uses
    the group filter criteria record you create as an input. In these steps you also define policy
    conditions that define how the policy uses the policy input to determine user access.

Configure a policy context
:   Configure the Post Authentication Policy Context to use your new
    policy. When configured, your instance denies access to users within the group defined in the
    filter criteria record.

## Create a filter criteria record {#ariaid-title2}

Learn how to create a criteria record to use as a policy input for your adaptive
authentication policy.

### Before you begin

Role required: adaptive_auth_admin

To deny access to your instance based on user groups, you must create a group filter
criteria record. This record defines a user group or a set of user groups that your
policy can grant or deny access. In this example, you will create a group filter
criteria record for a single user group.

For details on user groups and how they are used in your instance, see [Exploring user administration](https://www.servicenow.com/docs/access?context=exploring-user-administration&version=australia&pubname=australia-platform-administration&ft:locale=en-US).

### Procedure

1. Navigate to AllAdaptive AuthenticationFilter CriteriaGroup Criteria.
2. Click New to create a new record.
3. In the Name field, enter a name for your record.  
   For example, <kbd class="ph userinput">Denied Groups</kbd>.
4. In the Description field, enter a brief description.  
   For example, <kbd class="ph userinput">User groups denied access to the instance</kbd>.
5. In the Groups for criteria list, double-click Insert a new row....
6. Enter the name of a user group, or click the reference icon (![Reference icon]()) to select a group from a list.  
   If you want to create a new user group for your filter criteria, click the reference icon (![Reference icon]()), and then click the New button. For more details on creating user groups, see [Create a user
   group](https://www.servicenow.com/docs/access?context=t_CreateAGroup&version=australia&pubname=australia-platform-administration&ft:locale=en-US).
7. After you have added your user group, click Submit to save your criteria record.  

## Create a policy {#ariaid-title3}

Learn how to create a policy to deny access to user groups defined in your group filter criteria.

### Before you begin

Role required: adaptive_auth_admin

### Procedure

1. Navigate to AllAdaptive AuthenticationAuthentication PoliciesAll Policies.
2. In the Policies list, click New.
3. In the Name field, enter a name for your record.  
   For example, <kbd class="ph userinput">Deny by Group</kbd>.
4. In the Description field, enter a brief description.  
   For example, <kbd class="ph userinput">User groups denied access to the instance</kbd>.
5. Right-click the form header and click Save.  
   After saving, the Policy Inputs and Policy Conditions lists display on the form.
6. In the Policy Inputs list, click Edit.
7. In the list collector, add the filter criteria created in the previous steps to your policy.  
8. Click Save.  
   The instance saves the policy input and displays the policy record displays again.
9. In the Policy Conditions list, click New.
10. In the Label field, create a label for this condition, for example <kbd class="ph userinput">Deny by group</kbd>.
11. In the Description field, enter a brief description.  
    For example, <kbd class="ph userinput">Deny access to users in Denied Groups</kbd>.
12. In the Condition field, select the filter criteria you created in previous steps, then select is, and true to complete the condition.  
13. Click Save.

## Configure a policy context {#ariaid-title4}

Configure the Post Authentication Policy Context to use your new policy. When
configured, your instance denies access to users within the group defined in the filter
criteria record.

### Before you begin

Role required: adaptive_auth_admin

### Procedure

1. Adaptive AuthenticationAuth Policy ContextsPost Authentication Context.  
   You must use the Post Authentication Context because the policy used in this tutorial must evaluate what group a user is in. This information is only available after enters their credentials.
2. In the Default Policy field, select <kbd class="ph userinput">Deny Policy</kbd>.  
   This selection grants access to users by default, and only denies access when the policy conditions evaluate to true.
3. In the Deny Policy field, select the policy you created the previous steps.
4. Click Update to save the policy context record.

*[\>]: and then