Policies
List Access reusable policies
Get an Access reusable policy
Create an Access reusable policy
Update an Access reusable policy
Delete an Access reusable policy
ModelsExpand Collapse
class Policy: …
approval_groups: Optional[List[ApprovalGroup]]Administrators who can approve a temporary authentication request.
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
decision: Optional[Literal["allow", "deny", "non_identity", "bypass"]]The action Access will take if a user matches this policy.
The action Access will take if a user matches this policy.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
class PolicyListResponse: …
Requires the user to request access from an administrator at the start of each session.
connection_rules: Optional[ConnectionRules]The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config: Optional[MfaConfig]Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
class PolicyGetResponse: …
Requires the user to request access from an administrator at the start of each session.
connection_rules: Optional[ConnectionRules]The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config: Optional[MfaConfig]Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
class PolicyCreateResponse: …
Requires the user to request access from an administrator at the start of each session.
connection_rules: Optional[ConnectionRules]The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config: Optional[MfaConfig]Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
class PolicyUpdateResponse: …
Requires the user to request access from an administrator at the start of each session.
connection_rules: Optional[ConnectionRules]The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config: Optional[MfaConfig]Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.