Add rules to a policy

Enter a rule name

You can select resources by label or by name. Based on your selection, you need to perform other configurations.

Select servers by label

1. Toggle on Select resources by label.
2. In the Add resources field, search for and select a resource label. You can select multiple resource labels
3. Select one or both of the following access methods: Access resources by individual account or Access resources by vaulted account.
4. If you selected Access resources by individual account, select on of the following options: User-level permissions, Admin-level permissions, or User-level with sudo commands.
5. If you selected User-level with sudo commands, complete the following steps:
   1. In the Sudo commands field, enter a command name and press enter to select. You can add a maximum of 10 sudo command bundles per rule.
   2. In the End-user Display Name field, enter a nickname for the collection of sudo command bundles. The nickname is limited to 64 characters and you can only use the following characters: 0–9, A-Z, a-z, , -, _, and space.
6. If you selected Access resources by vaulted account, type the account name in the Select vaulted accounts field and press enter on your keyboard to select the account. You can add one or more accounts.

Select accounts by label

1. Toggle on Select resources by name.
2. Select one or more servers individually.

Optional. Okta resource admins must enroll and install a gateway before enabling session recording.

1. Select Enable traffic forwarding through gateways.
2. Select Record session through gateways.

Optional. Create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

1. Toggle on Enable approval requests.
2. Select the approval request type.
3. Choose how long you want the approval to last.

Optional. Click Reveal to enable users to decrypt the credentials of vaulted accounts and view them in plain text.

Enter a rule name.

1. Click Select secret folder or secret.
2. Select a secret folder or a secret
3. Click Save.

Select the permissions. You must select at least one permission. See Secret permissions for details.

Create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

1. Toggle on Enable approval requests.
2. Select the approval request type.
3. Choose how long you want the approval to last.

Enter a rule name.

1. Click the Select individual accounts checkbox.
2. Optional. Select an Operator, and then enter a Value.
3. Optional. Enter one or more domain names in the Domains field.
4. Click the Select shared accounts by matching names checkbox.
5. Enter one or more accounts in the Accounts name field.
6. Optional. Enter one or more domain names in the Domains field.
7. Under Select share accounts by specific accounts, use the search bar to search for an account, and then select one or more accounts.

Select at least one of the following options:

• Reveal: Enables the user to decrypt credentials and view it in plain text.
• Rotate Password: Grants the user permission to rotate the password.
• RDP session: Grants the user permission to initiate an RDP session on Windows servers.
• The following option becomes available when you select RDP session . You can specify servers in an Active Directory (AD) policy rule, allowing users to start RDP sessions on those servers with the targeted AD accounts.
  1. Select By label.
  2. In the Add resources field, search for and select a server label. You can select multiple server labels.
  3. Select By name, and then select one or more servers individually.
  4. Choose one of the following options to determine Okta Privileged Access's management of local group membership. The first two options add the account to either the Administrators group or the Remote Desktop Users group. If you're using another method for managing local groups, select Not to be added to any local groups.
     • Be added to "Remote Desktop Users" group
     • Be added to "Administrators" group
     • Not be added to any local group.

     This doesn't apply to domain controllers unless the sftd.yaml file on the domain controller is configured to allow group management. See Windows domain controller.

• SSH Session: Enables authenticated Active Directory domain accounts to connect to Linux servers in their AD domain though SSH.

  Using a non-fully qualified username without an existing local user prevents Active Directory account creation and causes sign-in failure.

  1. Select By label.
  2. In the Add resources field, search for and select a server label. You can select multiple server labels.
  3. Select By name, and then select one or more servers individually.

Optional. Okta resource admins must enroll and install a gateway before enabling session recording.

1. Select Enable traffic forwarding through gateways.
2. Select Record session through gateways.

If you enable traffic forwarding and session recording, this condition applies to both RDP and SSH sessions.

Optional. You must create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

1. Toggle on Enable approval requests.
2. Select the approval request type.
3. Choose how long you want the approval to last.

Optional. Enable MFA to add a granular level of authentication and control within a policy.

1. Toggle on Enable MFA.
2. Select one of the following options: Any two-factor types or Phishing resistant.
3. Select one of the following re-authentication frequencies:
   • Every SSH or RDP connection attempt: Enforces MFA for each attempt to access the resource.
   • After the specified duration: Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes.

After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.