Policy evaluation - PingID

Policy Evaluation

Policies are evaluated in the order in which they appear in the list on the Policy page as follows:

• The PingID policy service evaluates the first policy in the list on the Policy page and verifies whether the policy conditions are met. For example, if the user is trying to access one of the apps or is a member of one of the groups specified in the policy.
  • If the policy conditions are met, the PingID policy service does not evaluate any further policies and starts to evaluate the rules within the policy, as described in the next section.
  • If the policy conditions are not met, the PingID policy service evaluates the next policy that appears in the policy list.
  • If none of the policies were met, the default policy is applied.
  Note: If prompt user to select is enabled, there are some situations in which the user will be able to select a device with which to authenticate, but the policy applied to the organization will prevent the user from authenticating with the selected device, causing the user to be blocked.

Rule Evaluation

Once the policy conditions are met, the PingID policy service evaluates policy rules as follows:

• The PingID policy service evaluates the first rule in the policy and verifies whether the rule conditions are met. For example, for the Specific Countries rule, is the user signing on from one of the defined locations?
  • If the rule conditions are met, the PingID policy service does not evaluate any further rules, and the rule action is applied.
  • If the rule conditions are not met, or the information required is not available, such as the location, the PingID policy service evaluates the next rule in the policy rule list.
  • If none of the rule conditions are met or the information required is not available, such as the location, the default action is applied.

Consideration for users with multiple devices

If a user has more than one device paired with their account:

• If the primary device is disallowed by a rule action, the user is only allowed to authenticate if their secondary device is permitted in the rule action.
• If the user's primary device is allowed by the policy and:
  • Rule action permits the primary device: the user is prompted to authenticate using the primary device.
  • Rule action requires a different device: the user is prompted to authenticate using the device specified. If the device required is not paired then the user is denied access.
• If the user's primary device is not allowed by the policy, and they have only one secondary device:
  • If the secondary device is allowed by the policy and rule action, the secondary device is selected automatically.
  • If the secondary device is not allowed either at policy or rule level, authentication is denied.

Considerations for users working on a shared accessing device

Considerations for users working with more than one organization

The PingID policy supports a single user with multiple organizations and can distinguish between a user that is accessing more than one organization from the same accessing device. Policy information is stored on the device per user. This enables the PingID policy to evaluate users more accurately and consider users more accurately for policies, such as Recent authentication, per organization.