Security policy

A security policy controls which principals are granted privileged access to one or more resources. As a security admin, you create a policy, assign principals to the policy, and add one or more rules.

When creating a rule, you can establish specific conditions that users must meet to access a resource that's safeguarded by Okta Privileged Access. These rules can be customized for different resources by stacking or adding them until they cover all the privileged access needed for the set of principals. By doing this, you can set different controls over different resources to ensure that only authorized users can access them.

You can assign security administration to groups assigned as delegated security admins. The delegated security admins can then create policies that apply to resource groups for which they're the security owners. Security policies written by delegated security admins only apply to the resource group they selected when creating the policy. See Add a delegated security admin.

Prerequisites

  • Ensure that you're signed in to Okta Privileged Access.
  • You must have the Okta Privileged Access security admin role or a delegated security admin role.
  • Review Security policy concepts.

  • Learn how multiple authentication and authorization conditions affect user access. See Rule conditions.

Create or update a security policy

To create a policy, you need to add a policy name, assign principals, and create rules that apply to the principals. After a policy is created, it must be published. A policy doesn't have any effect until it's published.

  1. Go to Security Administration Policies..
  2. Click Create Policy.
  3. Enter a policy name and description.

  4. Configure the resource group information.

    Setting Action
    All resource groups Select this option to apply the policy to all resource groups.

    Delegated security admins can't select this option.

    Specify a resource group

    Select this option to apply the policy to a specific resource group.

    Maximum checkout time

    Optional. This time limit applies to any resources in this policy that has checkout enabled.

    1. Toggle Override the project-level maximum checkout time.

    2. Set the Amount and Duration.
  5. Click Select PrincipalsAdd or modify.
  6. Select one or more groups that you want to add or modify, and then click Save.
  7. Add rule to define the scope of resources and how to grant privileged access to these resources. You can configure the following rules: Server rule and Secret rule.
    1. To add a server rule, select Add rule Server Rule.
      SettingAction
      Rule nameEnter a rule name.
      Choose a session typeUse the dropdown menu and choose a session type.
      Select the resources that you want to protect with this ruleYou can select resources by label or by name. Based on your selection, you need to perform other configurations.

      Select resources by label

      1. Turn on the Select resources by label toggle.
      2. In the Add resources field, search for and select a resource label. You can select multiple resource labels. See Security policy to learn more about labels.

      Select resources by name

      1. Turn on the Select resources by name toggle.
      2. Select one or more accounts individually.
      Access methodSelect either one or both options on how you want principals to access the resources.

      • Access resources by individual account

      • Access resources by vaulted account

      Based on your selection, you need to configure the following:

      Access resources by individual account

      This option allows principals to sing in to resources with an individual account that Okta creates and manages automatically.

      1. Select one of the following options:

        • User-level permissions

        • Admin-level permissions

        • User-level with sudo commands

      2. If you select User-level with sudo commands, complete the following extra steps:

        1. In the Sudo commands field, enter a command name and press enter to select. You can add a maximum of 10 sudo command bundles per rule.

        2. In the End-user Display Name field, enter a nickname for the collection of sudo command bundles. The nickname is limited to 64 characters and you can only use the following characters: 0–9, A-Z, a-z, , -, _, and space.

      Access resources by vaulted account

      Type the account name in the Select vaulted accounts field and press enter on your keyboard to select the account. You can add one or more accounts.

      Enable session recordingOptional. Okta resource admins must enroll and install a gateway before enabling session recording.
      1. Select Enable traffic forwarding through gateways.
      2. Select Record session through gateways.
      Configure approval requestsOptional. Create a Request Type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.
      1. Select a workflow from the dropdown menu.
      2. Choose how long you want the approval to last.
      3. Optional. Select the setting to rotate the password after the approval duration ends.

      For Okta to take control of managing local account passwords on Windows servers, users must disable any password age restrictions that might prevent Okta from changing or rotating the password.

      Enable MFAOptional. Enable MFA to add a granular level of authentication and control within a policy.

      1. Turn on the Enable MFA toggle.

      2. Select one of the following options:

        • Any two-factor types

        • Phishing resistant

      3. Select one of the following re-authentication frequencies:

        • Every SSH or RDP connection attempt

          You can choose to enforce MFA for each attempt to access the resource.

        • After the specified duration

          By default, the specified duration is set to 30 minutes. You can specify a time duration ranging from 5 minutes to 12 hours.

      After the policy is implemented, when a user tries to connect with a resource, they'll need to complete the necessary MFA steps.

    2. To add a secret rule, select Add rule Secret Rule.

      SettingAction
      Rule nameEnter a rule name.
      Select the secret folder or secret you want to protect with this rule

      1. Click Select secret folder or secret.

      2. Select a secret folder or a secret

      3. Click Save.

      Select PermissionsSelect the permissions. You must select at least one permission. See Secret permissions for details.
      Approval requestsCreate a Request Type in Access Requests first for the access request workflow to be visible in the security policy. See Okta Privileged Access with Access Requests.

      1. Select the approval Request Type.

      2. Choose how long you want the approval to last.

  8. Click Save policy. You can now publish this policy.

Publish a policy

After a policy is created it must be published.

When a published policy is changed, the changes are applied immediately without the need to publish the policy again.

  1. Go to Security Administration Policies.
  2. On the policy you want to publish, click Actions.
  3. Click Publish to grant access to the policy.

Clone a policy

Security admins can clone an existing policy instead of creating an entirely new policy from scratch.

  1. Go to Security Administration Policies.
  2. On the policy you want to clone, click Actions.
  3. Select Clone.
  4. Click Save Policy.

Related topics

Okta Privileged Access with Access Requests

Multifactor authentication

Okta Privileged Access

Secret permissions

Sudo command bundle

Okta Privileged Access user guide