Security requirements often dictate restricting application access to users from specific countries. Administrators create a Dynamic Zone specifying the allowed or blocked countries and apply it to an existing application sign-in policy rule to enforce these geographical restrictions.

• Okta Identity Engine (OIE)
• Dynamic Zones
• Authentication Policies
• App Sign-in Policies

How does Okta use a Dynamic Zone to restrict country access?

Navigate to the network security settings in the Admin Console to create a new Dynamic Zone and select the appropriate countries to allow or block.

1. Navigate to Security > Networks.
2. Select Add Zone > Dynamic Zone.
3. Enter a name for the new zone.
4. In the Locations field, select the appropriate country to allow.
   
5. Select Save.

How does Okta use an authentication policy that requires the Dynamic Zone to enforce the restriction?

Locate the relevant application sign-in policy in the Admin Console, edit the rule conditions to require the newly created Dynamic Zone, and ensure subsequent rules deny access.

1. Navigate to Security > Authentication Policies.
2. Locate and select the app sign-in policy that applies to the desired application.
3. Find the relevant rule within the policy and select Edit.
4. In the IF condition section, locate the And User's IP is dropdown menu and select the newly created Dynamic Zone.
   
5. Select Save.
6. Ensure all rules below this rule are set to DENY access.
7. Verify that users have the intended access based on the new policy rule.

Related References

• Create a dynamic zone
• Authentication policies
• Restrict Specific Countries' Access to an Okta Tenant