--- title: Configuring an accessing from company network rule (web policy) description: Use this rule to define: component: pingid page_id: pingid:pingid_service_management:pid_configuring_accessing_company_network_rule_web_policy canonical_url: http://docs.pingidentity.com/pingid/pingid_service_management/pid_configuring_accessing_company_network_rule_web_policy.html revdate: March 12, 2026 section_ids: about-this-task: About this task steps: Steps result: Result: choose-from: Choose from: result-2: Result: result-3: Result: next-steps: Next steps --- # Configuring an accessing from company network rule (web policy) ## About this task Use this rule to define: * The authentication action to prompt the user with if the web accessing device is within the company network, such as requiring a specific authentication method when within the company network, like **Mobile App Biometrics** or **Swipe**, or allowing silent authentication when within the company network. * Optionally require the user's mobile authenticating device to be located within a defined office location during authentication with the **Authenticating Device in Company Offices** option. If this option is enabled, to sign on: * The user's authenticating device must be in a company office location. * The user's accessing device must originate from an IP address within the company network. When creating this rule, you must specify the IP addresses that define the company network or define the geographic location of one or more offices around the world or both. When a proxy is used, it masks the user's original IP address. As a result, PingID can't accurately verify the user's location, and this rule won't function as expected. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | If you're using PingOne DaVinci to orchestrate your PingID flows, the **authenticating device in company offices** section isn't included in the policy evaluation. | ## Steps 1. In PingOne, go to **Setup > PingID > Policy**. 2. From within the relevant policy, click **[icon: plus, set=fa]Add Rule**, and in the rule list, select **Accessing From Company Network**. ![A screen capture of the + Add Rule button displaying the rule list options.](_images/qxy1564020515392.png) ### Result: The **Accessing From Company Network** configuration wizard opens. ![A screen capture of the Accessing From Company Network configuration wizard.](_images/bjw1564020572691.png) 3. From the **Action** list, select the authentication action to use if the rule conditions are met. ### Choose from: * **Approve**: Approve access without requiring PingID authentication. * **Authenticate**: Allow the user to authenticate using any of the authentication methods available to the user, and allowed at the policy level. * **Allowed Methods**: Click **Allowed Methods** to reveal a list of authentication methods allowed by this policy, and then select the checkbox of each authentication method that you want to allow for this rule. Learn more in [Rule authentication actions](pid_rule_auth_actions.html) for description per authentication type. 4. In the **IP Addresses** field, enter a list of external IP addresses or the IP range that belongs to the company network. | | | | - | -------------------------------------------------------------------------------------- | | | Enter the IP addresses and ranges using CIDR notation with each entry on its own line. | 5. To require a user's authenticating device to be in the company offices when signing on from within the company network: 1. Go to the **Authenticating Device In Company Offices** section. 2. Click **Enable**. 3. Define one or more company office locations. If the authenticating device is located within one of the defined areas, it's considered to be inside a company office. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | If you're including a company office location in this rule, **Swipe**, **Mobile App Biometrics**, or a **One-time passcode** must be defined as an **Allowed Authentication Method** to ensure location-based information can be collected from the user. | ### Result: The **Office Locations** wizard opens enabling you to define one or more office locations. ![A screen capture of the Office Locations wizard with one defined location and with the search location feature open with an "O" entered and results listed.](_images/mge1564020573334.png) 6. To define additional office locations: 1. Click **[icon: plus, set=fa]Add Office** or enter an address in the search box. ### Result: A blue circle displays on the map defining the office area. ![A screen capture of the Office Locations wizard with a defined office location and a blue circle identifying the location on the map.](_images/ynq1564020574046.png) 2. Use the white dots on the circle to fine-tune the geofence: ![A screen capture of the blue circle with white dots in the center and on the rim enabling the edit of the coordinates.](_images/ooc1564020518625.png) * To reposition the circle, click and drag the white dot at the circle's center to the wanted location. * To resize the circle, click and drag any white dot on the circle's rim. 1. To add another office location, click a location outside the circle. A new circle is added. 2. To edit an office location, click the **Pencil** icon (![fnb1564020519171](_images/fnb1564020519171.png)) and edit the name. By default, the location is named after its street address. ![A screen capture of an added Office location defined by its street address.](_images/bsi1564020519674.png) 3. To delete an office address, click the **Minus** icon (![pmh1564020520189](_images/pmh1564020520189.png)). | | | | - | ------------------------------------------------------------------------------------------------------------------------------- | | | If you edit or delete offices in the **Office Locations** list, changes are applied to all rules that specify office locations. | 7. To save the rule and apply it to the relevant policy, click **Save**. 8. To rearrange and save the new policy order, in the policy list, click and drag the new policy and place it in the order in which you want it to be considered. Click **Save Order**. ## Next steps To ensure the policy is applied to your organization, go to **PingID > Configuration** and ensure **Enforce Policy** is set to **Enabled**.