Skip to main content
日本語 简体中文 繁體中文

[Access Control] Create / Edit Access Policy Group

Action summary

This article explains the procedure for creating and editing Access Policy Groups for administrators who perform initial setup and operational management of Access Control.

Notes

  1. The content of this article is based on product specifications as of August 2026 and may change without notice.
  2. Global administrator privileges for Access Control are required to view actual screens or make configuration changes.
  3. For instructions on how to access the Administration, please refer to the following article.
    How to Access the Access Control Administration
  4. Changes take effect immediately, but will be applied to user access control from the next login onward.

Procedure

  1. In the Access Control Administration, go to the left menu and select [Access Control] – [Access Policy Groups].

    Screen selecting Access Control from the left menu in Access Control Administration

  2. Click [Add] in the upper right of the screen, or select one of the existing Access Policy Groups.

    Screen for selecting Add button or group in Access Policy Groups list

  3. Enter or edit each field, then click [Save] or [Save Changes] in the lower right of the screen.
    * For descriptions of each field, please refer to the Fields (Basic Settings) section below.

    Screen for entering and saving Access Policy Group basic settings

Next steps

Assign Access Policy Groups to users.
* If Access Policy Groups have already been assigned, no further action is required.
For assignment procedures, please refer to the following article.
Assigning Access Policy Groups to Users in Access Control

Fields (Basic Settings)

The displayed fields may vary depending on your contract.
For details about Access Policy Templates, please refer to the following article.
Creating and Editing New Access Policy Templates in Access Control

Name Description Notes
Display Name Name of the Access Policy Group Up to 256 characters can be set.
Cookie lifespan If [Remember this login] is checked on the login screen: The period during which the login state is maintained by cookies in the browser Except when the user logs out themselves, the login state will be maintained within the set period even if the browser is restarted.
* Can be set up to a maximum of 9,600 hours.
If left blank, logging out will occur when the browser is closed.
* The period for maintaining the login state by authentication cookies applies only between the browser and Access Control. If the connected service manages its own session, the Access Control login screen may be displayed even within the cookie lifespan if the service session expires.
If [Remember this login] is not checked or not displayed on the login screen: The maximum session duration for user login If a single page is kept open beyond the set time, the user will need to log in again when navigating to another page.
* If [Remember this login] is not checked or not displayed, logging out will occur when the browser is closed.
Condition to allow access
  • Always allow: Allow all access.
  • Allow under the following conditions: Allow access only from environments that match the predicate. (Select conditions from Access Policy Templates)
  • Never allow: Do not allow any access.
Condition to allow legacy authentication
  • Always allow: Allow all access via legacy authentication.
  • Allow under the following conditions: Allow login requests using SAML ECP and Ws-Trust authentication only under conditions that match the predicate. (Select conditions from Access Policy Templates)
  • Never allow: Do not allow any access.
 Displayed only when integrated with Microsoft 365.

Fields (OTP Settings)

Name Description Notes
Skip OTP authentication
  • Never allow OTP to be skipped: OTP will always be required.
  • Skip OTP authentication under the following conditions: OTP will not be required when accessing from environments that match the predicate.
  • Always require OTP: OTP will always be required.
Condition to change OTP secret
  • Always allow: Always allow changing the OTP secret.
  • Allow under the following conditions: Allow changing the OTP secret only when accessing under conditions that match the predicate (select conditions from Access Policy Templates).
  • Never allow: Never allow changing the OTP secret.
 If both [Condition to change OTP notification email] and this condition are set to [Never allow], the [OTP Settings] menu will not be displayed on the user screen.
Condition to change OTP notification email
  • Always allow: Always allow changing the OTP notification email.
  • Allow under the following conditions: Allow changing the OTP notification email only when accessing under conditions that match the predicate (select conditions from Access Policy Templates).
  • Never allow: Never allow changing the OTP notification email.
 If both [Condition to change OTP secret] and this condition are set to [Never allow], the [OTP Settings] menu will not be displayed on the user screen.

Fields (Device Certificate Settings)

Name Description Notes
Condition to allow users to view their own Device Certificates
  • Always allow: Always allow access to the Device Certificates screen.
  • Allow under the following conditions: Allow access to the Device Certificates screen only when accessing from environments that match the predicate (select conditions from Access Policy Templates).
  • Never allow: Never allow access to the Device Certificates screen.
 If access is not allowed, the "Device Certificates" menu will not be displayed in the upper right of the user portal.
Condition to allow users to revoke Device Certificates
  • Always allow: Always allow revoking Device Certificates.
  • Allow under the following conditions: Allow revoking Device Certificates only when accessing from environments that match the predicate (select conditions from Access Policy Templates).
  • Never allow: Never allow revoking Device Certificates.
 This feature requires permission for [Condition to allow users to view their own Device Certificates].

Fields (Secure Browser Settings)

Name Description Notes
Condition to access the secure browser control panel
  • Always allow: Always allow access to the Secure Browser control panel
  • Allow under the following conditions: Allow access to the Secure Browser control panel only when accessing from environments that match the predicate (select conditions from Access Policy Templates)
  • Never allow: Never allow access to the Secure Browser control panel
Condition to allow access to the unread mail check settings screen
  • Always allow: Always allow access to the unread mail check settings screen
  • Allow under the following conditions: Allow access to the unread mail check settings screen only when accessing from environments that match the predicate (select conditions from Access Policy Templates)
  • Never allow: Never allow access to the unread mail check settings screen
Automatically authenticate
  • Default: Use the settings from Access Control Administration
  • Enabled: Automatically accept device authentication requests
  • Disabled: Admin must manually authenticate devices
 The default setting can be checked at [Domain Settings] – [Secure Browser Settings] – [General] – [Automatically authenticate].
For the procedure to manually authenticate devices when disabled, please refer to the following article.
Device Authentication for Secure Browser

Fields (Allowed services)

In the Access Control Administration, go to [System] – [Connected Services] to configure whether to allow access to integrated services.

You can control access for each integrated cloud service.
To allow access, enable the [Allow] switch and specify [Condition to allow access] and [Skip OTP authentication] for each service.

Screen for configuring allowed services

Name Description Notes
Condition to allow access
  • Always allow: Allow all access
  • Follow access policy group: Allow if the conditions of the target Access Policy Group are met
  • Select from Access Policy Templates: Select conditions from Access Policy Templates
 Set the conditions to allow access for each integrated cloud service.
Skip OTP authentication
  • Always require OTP: Always require OTP
  • Never allow OTP to be skipped: Do not require OTP
  • Follow access policy group: Allow if the conditions of the target Access Policy Group are met
  • Select from Access Policy Templates: Select conditions from Access Policy Templates
 Set the conditions for requiring OTP for each integrated cloud service.

  Translation Disclaimer
  
  This article has been automatically translated from the original Japanese version   for your convenience.
  While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.
  
  In the event of any discrepancies or questions regarding the content, the official   Japanese version shall prevail.