> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/register-and-configure-applications/adding-an-application/entering-the-application-details/assigning-roles-and-authentication.md).

# Assigning roles and authentication

{% stepper %}
{% step %}

## Define roles

Step 2 defines the roles that exist inside the application and what each one can do.

![The Assign Roles step.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/ler6b0GbzFG1aYbBLeLq/assets/image24.png)

![Multiple roles can be defined, each with its own permissions.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/niZ2iF0uszK2jZq1NjGT/assets/image25.png)

For each role, enter a **Role Name** (required) and a **Role Description**, then set its **Permissions** — **Read**, **Write**, **Admin** or **Custom**.

Click **+ Add Another Role** to define more roles, or **Remove** to drop one.

Click **Next**.
{% endstep %}

{% step %}

## Set authentication

Step 3 decides how users authenticate to this application. Authentication is set per role, so an administrator can be held to a stronger standard than an ordinary user.

![The Authentication step.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/cz5C99tJVLoo0axKb8Oa/assets/image26.png)

Pick the roles this rule applies to in **Assign to Roles**, then build the **Authentication Pairs**:

| Field                   | Description                                                                |
| ----------------------- | -------------------------------------------------------------------------- |
| **Authentication Mode** | The factor to use — password, OTP, push, and so on                         |
| **Authentication Type** | **Primary** for the first factor, **Secondary** for the second, and so on  |
| **Applicability**       | **Mandatory** or **Adaptive (Risk-based)** — second and later factors only |

Use **+ Add Auth Method** to add another pair, and **+ New Authentication Method** to define a mode that does not exist yet. Repeat the whole block for each role that needs a different standard.

{% hint style="info" %}
Choose **Adaptive (Risk-based)** for frequently used, moderate-sensitivity applications, where prompting on every sign-in creates more friction than it is worth. Keep **Mandatory** for privileged or audited applications, where the factor must be presented every session.
{% endhint %}

**Blocked Settings** sits below the authentication pairs. Enabling it lets you block access from particular IP addresses, locations, browsers or operating systems — the check runs before authentication begins.

Click **Submit**. The application appears in the list with its status, sign-in method and actions.

![The new application in the applications list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/7gsf9XS7fx7ePj9qIUSk/assets/image27.png)
{% endstep %}
{% endstepper %}