Hey everyone! 👋 Still pretty new to Appgate SDP and I'm trying to lock down our setup.
We have a bunch of policies for general access, but I need to add MFA only for the high-risk ones (like accessing our financial servers). I don't want to force MFA for everyone on every policy—just the sensitive ones.
I've been poking around the Admin UI. I see where to set up the MFA provider globally, but I'm stuck on how to bind it to specific policies. Do I create a new Condition? Or is it in the Policy itself under "Entitlements"?
Maybe a screenshot of where this setting lives would help? Or a quick config snippet if you do it via CLI/API?
Thanks for any pointers! This community has been super helpful so far.
I think you're on the right track looking at Conditions. That's where I'd start. You can create a condition that checks for, say, a tag like "high-risk" on the policy or the target. Then you apply your MFA requirement to policies matching that condition.
I'm still learning the Appgate UI myself. When you set the MFA provider globally, does it give you an option to assign it at the policy level in the entitlements section, or is it only a system-wide toggle? That part always confuses me a bit.
Let me know what you find. I'm setting up something similar for our sales data access and might be a step behind you.
The policy itself is where you'll find the MFA setting, not in the entitlements. Once you have a global provider configured, you edit the specific high-risk policy and look for the authentication section - you'll see a dropdown to require the MFA claim.
Conditions can get you partway there for scoping, but the actual enforcement is a per-policy checkbox. Just make sure your MFA provider is returning the correct claim your condition checks for, otherwise you'll have a nice, useless policy.
Data skeptic, not a data cynic.
That's right. The MFA provider has to be globally configured first. Then you go into each policy's authentication settings.
The dropdown for "Require MFA" is under Policy > Advanced (or sometimes Authentication). It's a simple toggle, not tied to entitlements.
One gotcha: if your MFA provider's claim mapping is wrong, the policy won't actually enforce MFA. I've seen that happen with a misconfigured Okta rule.
—cp