Add rules to a policy

Add rules to define the scope of resources and how to grant privileged access to these resources. The type of rule you can add depends on the policy type you've set up. The Okta service account policy only allows you to add rule types for Okta, while the default policy lets you add rules for any policy type except Okta.

Before you begin

  • You must have an existing policy or be in the process of creating a policy. See Create or update a security policy.
  • You must have a security admin or delegated security admin role

Add rules for a default policy

You can add this rule for server, secrets, SaaS app service accounts, or Active Directory accounts.

  1. Go to Security Administration Policies.
  2. Select the policy where you want to add a rule.
  3. Select Add rule, and then select one of the rule type:
    • Server rule
    • Secret rule
    • SaaS app service account rule
    • Active Directory account rule
  4. If you selected Server rule, complete the following:
    SettingAction

    Rule name

    Enter a rule name

    Select the resources that you want to protect with this rule

    You can select resources by label or by name. Based on your selection, you need to perform other configurations.

    Select resources by label

    1. Toggle Select resources by label.
    2. In the Add resources field, search for and select a resource label. You can select multiple resource labels. See Security policy concepts to learn more about labels.

    Select resources by name

    1. Toggle Select resources by name.
    2. Select one or more accounts individually.

    Access method

    Select either one or both options on how you want principals to access the resources.

    • Access resources by individual account
    • Access resources by vaulted account

    Based on your selection, you need to configure the following:

    Access resources by individual account

    This option allows principals to sing in to resources with an individual account that Okta creates and manages automatically.

    Select one of the following options:

    • User-level permissions
    • Admin-level permissions
    • User-level with sudo commands

    If you select User-level with sudo commands, complete the following extra steps:

    1. In the Sudo commands field, enter a command name and press enter to select. You can add a maximum of 10 sudo command bundles per rule.
    2. In the End-user Display Name field, enter a nickname for the collection of sudo command bundles. The nickname is limited to 64 characters and you can only use the following characters: 0–9, A-Z, a-z, , -, _, and space.

    Access resources by vaulted account

    Type the account name in the Select vaulted accounts field and press enter on your keyboard to select the account. You can add one or more accounts.

    Enable session recording

    Optional. Okta resource admins must enroll and install a gateway before enabling session recording.

    1. Select Enable traffic forwarding through gateways.
    2. Select Record session through gateways.

    Approval requests

    Optional. Create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

    1. Toggle Enable approval requests.
    2. Select the approval request type.
    3. Choose how long you want the approval to last.

    Enable MFA

    Optional. Enable MFA to add a granular level of authentication and control within a policy.

    1. Toggle Enable MFA.
    2. Select one of the following options: Any two-factor types or Phishing resistant.
    3. Select one of the following re-authentication frequencies: Every SSH or RDP connection attempt (Enforces MFA for each attempt to access the resource) or After the specified duration (Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes).

    After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.

  5. If you selected Secret rule, compete the following:
    SettingAction

    Rule name

    Enter a rule name.

    Select the secret folder or secret you want to protect with this rule

    1. Click Select secret folder or secret.
    2. Select a secret folder or a secret
    3. Click Save.

    Select permissions

    Select the permissions. You must select at least one permission. See Secret permissions for details.

    Approval requests

    Create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

    1. Toggle Enable approval requests.
    2. Select the approval request type.
    3. Choose how long you want the approval to last.

    Enable MFA

    Optional. Enable MFA to add a granular level of authentication and control within a policy.

    1. Toggle Enable MFA.
    2. Select one of the following options: Any two-factor types or Phishing resistant.
    3. Select one of the following re-authentication frequencies: Every guarded action a user takes: (Enforces MFA for each attempt to access the resource) or After the specified duration (Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes).
  6. If you selected SaaS app service account rule, complete the following:
    1. Enter a rule name.
    2. Select one of the following password update methods:
      • Automated
      • Manual
    3. If you selected the Automated method, complete the following:
      SettingAction

      Accounts to protect

      Select the accounts that you want to protect with this rule.

      Select accounts by label

      1. Toggle Select accounts by label.
      2. Click the Accounts dropdown, and then add one or more labels.

      Select accounts by name

      1. Toggle Select resources by name.
      2. Select one or more accounts individually.

      Approval requests

      Optional. You must create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

      1. Toggle Enable approval requests.
      2. Select the approval request type.
      3. Choose how long you want the approval to last.

      Enable MFA

      Optional. Enable MFA to add a granular level of authentication and control within a policy.

      1. Toggle Enable MFA.
      2. Select one of the following options: Any two-factor types or Phishing resistant.
      3. Select one of the following re-authentication frequencies: Every guarded action a user takes: (Enforces MFA for each attempt to access the resource) or After the specified duration (Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes).

      After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.

      Maximum checkout time

      Optional. This time limit applies to any resources in this policy that has checkout enabled.

      1. Toggle Override the project-level maximum checkout time.
      2. Set the Quantity and Unit.
    4. If you selected the Manual method, complete the following:
      SettingAction

      Permission for accounts

      Select Reveal, Updated, or both.

      Accounts to protect

      Select accounts by label.

      1. Toggle Select resources by name.
      2. Click the Accounts dropdown, and then add one or more labels.

      Select accounts by name

      1. Toggle Select resources by name.
      2. Select one or more accounts individually.

      Approval requests

      Optional. You must create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

      1. Toggle Enable approval requests.
      2. Select the approval request type.
      3. Choose how long you want the approval to last.

      Enable MFA

      Optional. Enable MFA to add a granular level of authentication and control within a policy.

      1. Toggle Enable MFA.
      2. Select one of the following options: Any two-factor types or Phishing resistant.
      3. Select one of the following re-authentication frequencies: Every guarded action a user takes: (Enforces MFA for each attempt to access the resource) or After the specified duration (Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes).

      After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.

  7. If you selected Active Directory account rule, complete the following:
    SettingAction

    Rule name

    Enter a rule name.

    Accounts to protect

    Select individual accounts

    1. Click the Select individual accounts checkbox.

    2. Optional. Select an Operator, and then enter a Value.

    3. Optional. Enter one or more domain names in the Domains field.

    Select shared accounts by name

    1. Click the Select shared accounts checkbox.

    2. Enter one or more accounts in the Accounts name field.

    3. Optional. Enter one or more domain names in the Domains field.

    Select specific shared accounts

    Under Select share accounts by specific accounts, use the search bar to search for an account, and then select one or more accounts.

    Shared Accounts by Name match any account by that name. The account doesn't need to exist and any account, now or in the future, which has that name is a match.

    When selecting specific accounts, you're actually selecting an exact account and SID. If the account is deleted and recreated in that domain with the same name but a different SID it will no longer be a match for this policy and would need to be reselected.

    Approval requests

    Optional. You must create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

    1. Toggle Enable approval requests.
    2. Select the approval request type.
    3. Choose how long you want the approval to last.

    Enable MFA

    Optional. Enable MFA to add a granular level of authentication and control within a policy.

    1. Toggle Enable MFA.
    2. Select one of the following options: Any two-factor types or Phishing resistant.
    3. Select one of the following re-authentication frequencies: Every guarded action a user takes: (Enforces MFA for each attempt to access the resource) or After the specified duration (Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes).

    After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.

    Maximum checkout time

    Optional. This time limit applies to any resources in this policy that has checkout enabled.

    1. Toggle Override the project-level maximum checkout time.
    2. Set the Amount and Duration.
  8. Click Save rule. You can now publish this policy.

Add rules for Okta service account policy

Add this rule for Okta service accounts policy.

  1. Go to Security Administration Policies.
  2. Select the policy where you want to add a rule.
  3. Select Add rule, and then complete the following:
    SettingAction

    Rule name

    Enter a rule name.

    Accounts to protect

    You can select resources by label or by name. Based on your selection, you need to perform other configurations.

    Select accounts by name

    1. Toggle Select accounts by name.
    2. Select one or more accounts individually.

    Approval requests

    Optional. You must create a request type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

    1. Toggle Enable approval requests.
    2. Select the approval request type.
    3. Choose how long you want the approval to last.

    Enable MFA

    Optional. Enable MFA to add a granular level of authentication and control within a policy.

    1. Toggle Enable MFA.
    2. Select one of the following options: Any two-factor types or Phishing resistant.
    3. Select one of the following re-authentication frequencies: Every guarded action a user takes: (Enforces MFA for each attempt to access the resource) or After the specified duration (Specify a time duration between 5 minutes and 12 hours, with the default being 30 minutes).

    After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.

    Maximum checkout time

    Optional. This time limit applies to any resources in this policy that has checkout enabled.

    1. Toggle Override the project-level maximum checkout time.
    2. Set the Amount and Duration.
  4. Click Save rule.
  5. Click Save policy. You can now publish this policy.

Related topics

Security policy

Okta Privileged Access with Access Requests