How to Add Okta Expression Language in Authentication Policy Rules
Nov 4, 2025
Administration
Okta Classic Engine
Okta Identity Engine
Overview
The Authentication Policy rule offers the option to add a condition using Okta Expression Language.
Applies To
- Using Expression Language
- Okta Identity Engine (OIE)
Solution
To add this condition, follow the next steps:
- Log in to the Admin Dashboard.
- Navigate to Security > Authentication Policies > App sign-in.
- Select an existing policy or click Add a Policy.
- Click Edit or Add Rule.
- Locate The following custom expression is true section and add the expression.
-
- For example, to "Restrict a rule to members of a certain group", use:
user.isMemberOf({'group.profile.name': 'Managers', 'operator': 'EXACT'}) - To restrict a rule based on the user's profile attributes, such as department, state, or cost center, use:
user.profile.department == "Help Desk"
- For example, to "Restrict a rule to members of a certain group", use:
-
-
- Or use a combination of conditions:
user.status == 'ACTIVE' && user.profile.department == "Help Desk"
- Or use a combination of conditions:
-
- Save changes and test.
