This article clarifies the process for creating explicit allow rules, or an allowlist, for signing on to Okta using a defined network zone. The configuration ensures that login attempts are only permitted from specific zones when the IP addresses to be blocked are unknown.
- Network Zone
- Sign on Rule
- Global Session Policy
NOTE: Before proceeding with the following steps, create an account belonging to a group that the Sign On rule and defined network zone will not impact. This prevents a possible lockout condition that could affect the administrator creating this rule.
Define the Network Zone
-
Sign in to the Admin Console.
-
Go to Security > Networks > Add Zone > IP/Dynamic Zone.
-
Select all required zones for this blocklist or add the required IP addresses to the list.
-
Click Save.
Steps for Okta Classic Engine
A. Create a Deny Rule
-
Sign in to the Admin Console.
-
Go to Security > Authentication > Sign On.
-
Click Add New Okta Sign-on Policy.
-
Enter the policy details, click Create Policy and Add Rule.
-
In the Add Rule window, under User's IP is, select Anywhere.
-
Enter the name for the zone to be blocked.
-
For Access is, select Denied.
-
Click Save.
NOTE: This rule will Deny all connections for anyone from this group accessing the tenant.
B. Create an Allow Rule
-
Click Add Rule within the newly created policy.
-
In the Add Rule window, under User's IP is, select In Zone and choose the defined allow zone.
-
For Access is, select Allowed.
-
Select any additional options required to verify the connection.
-
Click Save.
-
Ensure this allow rule is ranked above the deny rule.
NOTE: All incoming connection attempts will be evaluated based on the Group membership of the user and if the IP matches the defined IP, access will be allowed, however if the IP does not match, the logic will cascade down to the deny rule.
Steps for Okta Identity Engine (OIE)
A. Create a Deny Rule
-
Sign in to the Admin Console.
-
Go to Security > Global Session Policy.
-
Click Add Policy.
-
Enter the details, click Create Policy and Add Rule.
-
In the Edit Rule window, under User's IP is, select Anywhere.
-
Enter the name for the zone to be blocked.
-
For Access is, select Denied.
-
Click Save.
NOTE: This rule will Deny all connections for anyone from this group accessing the tenant.
B. Create an Allow Rule
-
Click Add Rule within the newly created policy.
-
In the Add Rule window, under User's IP is, select In Zone and choose the defined allow zone.
-
For Access is, select Allowed.
-
Select any additional options required to verify the connection.
-
Click Save.
-
Ensure this allow rule is ranked above the deny rule.
NOTE: All incoming connection attempts will be evaluated based on the Group membership of the user and if the IP matches the defined IP, access will be allowed, however if the IP does not match, the logic will cascade down to the deny rule.
