> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/adaptive-authentication-and-risk-profiles.md).

# Adaptive authentication and risk profiles

Adaptive authentication adjusts how hard a user has to work to prove who they are, based on how risky the sign-in looks. A familiar device on the office network is asked for less than the same account arriving from an unfamiliar country at three in the morning.

This guide covers the rules that decide what counts as risky, and where those rules are configured.

## What adaptive authentication does

Every sign-in is scored against context — where it came from, what device it is on, what time it is, and whether the behaviour matches the pattern for that user. A high score means more is demanded, or access is refused. A low score means the user gets on with their day.

The result is friction that lands where the risk is, rather than being spread evenly across everyone.

## Conditions, locations and trusted devices

Three kinds of signal do most of the work.

**Conditions** are the context a rule matches on — IP address or range, country, device, operating system, time of day, and the anomaly score from behavioural analysis.

**Locations** are geography treated as a first-class signal. A country can be trusted for an application, so access from it proceeds normally; anywhere else is treated with more suspicion.

**Trusted devices** are recognised endpoints. A device the user has registered carries less risk than one seen for the first time, and administrators can cap how many devices a single user may register.

## Where adaptive authentication is enforced

Adaptive authentication is enabled on the resource when you set its authentication, and the rules that drive it are configured under **Configuration → Blocked Settings**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/DUunPGMeP0DamlDMf2t7/assets/01.png)

Blocked Settings has four tabs: **IP Allowlist**, **IP Blocklist**, **Trusted Locations** and **Attribute Configuration**.

## IP allowlist

Trusted IPs are addresses that are always trusted. Traffic from them is treated as low risk.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/CvbVl9NpYovphtCr4xkc/assets/02.png)

| Column      | Shows                                                                                                  |
| ----------- | ------------------------------------------------------------------------------------------------------ |
| Application | The application the entry applies to. A dash means it applies generally rather than to one application |
| IP Address  | The trusted address or range                                                                           |
| Added On    | When it was added                                                                                      |
| Status      | **Active** or inactive                                                                                 |
| Actions     | Edit or delete the entry                                                                               |

{% stepper %}
{% step %}

### Add trusted IP addresses

Select **Add IP**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/yIthDvpsmJxgjfw0xcFS/assets/03.png)

Choose the **Application**, then enter the **IP Address**. A single address such as `192.168.1.100` or a range in CIDR form such as `10.0.0.0/24` are both accepted, and **+ Add more IP address** lets you enter several in one go.
{% endstep %}

{% step %}

### Save the addresses

Select **Add**. Those addresses are now trusted for that application.
{% endstep %}
{% endstepper %}

## IP blocklist

The blocklist is the mirror image: addresses refused access outright.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/FJbgTOk9CABBSKXKT0Aq/assets/04.png)

The columns are the same, with **Blocked On** in place of **Added On**. Select **Add IP**, choose the application and enter the addresses to block.

{% hint style="info" %}
**Note**

An address on both lists is a configuration error waiting to surprise someone. Check the other tab before adding.
{% endhint %}

## Trusted locations

Trusted locations name the countries that are trusted for an application.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/bFEIt1jzqwyVlfVTzSul/assets/05.png)

| Column      | Shows                                |
| ----------- | ------------------------------------ |
| Application | The application the entry applies to |
| Country     | The trusted country                  |
| Added On    | When it was added                    |
| Status      | **Active** or inactive               |
| Actions     | Edit or delete                       |

{% stepper %}
{% step %}

### Add trusted locations

Select **Add Location**, choose the **Application** and the **Country**, and use **+ Add more country** to add several at once.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/eIFm8pZiOxrQ8kRE2KFP/assets/06.png)
{% endstep %}

{% step %}

### Save the locations

Select **Add**.
{% endstep %}
{% endstepper %}

### Editing a location

The edit action reopens the entry so the application or country can be changed.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/jJIvCVN8ArviRFNW2q1n/assets/07.png)

Select **Update**.

### Deleting a location

The delete action asks for confirmation, naming the country being removed.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/ZftnA1tyD8gzUAPHB3pF/assets/08.png)

{% hint style="warning" %}
**Caution**

Deletion cannot be undone. Removing a trusted location does not block that country — it stops treating it as trusted, so access from there is scored as it would be from anywhere unlisted.
{% endhint %}

## Attribute configuration

Attribute Configuration sets the risk severity levels and the threshold score each one starts at.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/LaA3P2RCIu7nNCH29ewJ/assets/09.png)

| Risk severity | Threshold score |
| ------------- | --------------- |
| Low           | 25              |
| Medium        | 50              |
| High          | 75              |
| Critical      | 90              |

A sign-in is scored against the conditions above, and the score decides which severity band it lands in. The band then decides what the user is asked for.

Use the edit action on a row to change its threshold.

{% hint style="info" %}
**Note**

Move these carefully and one at a time. Lowering the Critical threshold does not just affect critical events — it widens the band and pulls sign-ins that used to be High into it, which changes behaviour for far more users than expected.
{% endhint %}

The rules live in one place: four tabs under Blocked Settings. Addresses you always trust, addresses you never trust, countries that count as normal, and the scores that decide what "risky" means.