This article describes how to create explicit deny rules for signing in to Okta using a defined network zone. It clarifies the process for blocking specific Internet Protocol (IP) addresses or dynamic zones from accessing the environment.
- Network Zone
- Sign on Rule
- Global Session Policy
NOTE: Before proceeding with the following steps, create an account that belongs to a group that the Sign On rule and the defined network zone will not impact. This prevents a possible lockout condition that could affect the administrator creating this rule.
Define the Network Zone
-
Sign in to the Admin Console.
-
Go to Security > Networks > Add Zone > IP/Dynamic Zone.
-
Select all required zones for this blocklist or add the required IP addresses to the list.
-
Click Save.
Steps for Okta Classic Engine
A. Create Deny Rule for Okta Classic Engine
-
Sign in to the Admin Console.
-
Go to Security > Authentication > Sign On.
-
Click Add New Okta Sign-on Policy.
-
Populate details, click Create policy, and select Add rule.
-
When the Add Rule window opens, select In Zone under User's IP.
-
Enter the name for the zone to be blocked.
-
Select Denied for Access is.
-
Click Save.
B. Create Allow Rule for Okta Classic Engine
-
While on the newly created rule, click Add Rule.
-
When the Add Rule window opens, select In Zone for a defined allow zone or select Anywhere under User's IP.
-
Select Allowed for Access is.
-
Select any other options needed to verify an allowed connection further.
-
Click Save.
-
Ensure that this rule resides above all other rules, with the Deny rule listed first.
NOTE: All incoming connection attempts from blocked regions will be denied, while allowed regions will cascade down the rules to have the respective rules applied.
Steps for Okta Identity Engine (OIE)
A. Create Deny Rule for Okta Identity Engine (OIE)
-
Sign in to the Admin Console.
-
Go to Security > Global Session Policy.
-
Click Add Policy.
-
Populate details, click Create policy, and select Add rule.
-
When the Edit Rule window opens, select In Zone under User's IP.
-
Enter the name for the zone to be blocked.
-
Select Denied for Access is.
-
Click Save.
NOTE: This rule will deny all connections for the defined zone listed in the rule.
B. Create Allow Rule for Okta Identity Engine (OIE)
-
While on the newly created rule, click Add Rule.
-
When the Add Rule window opens, select In Zone for a defined allow zone or select Anywhere under User's IP.
-
Select Allowed for Access is.
-
Select any other options needed to verify an allowed connection further.
-
Click Save.
-
Ensure that this rule resides above all other rules, with the Deny rule listed first.
NOTE: All incoming connection attempts from blocked regions will be denied, while allowed regions will cascade down the rules to have the respective rules applied.
