Skip to main content
日本語 简体中文 繁體中文

[Access Control] Creating/Editing Access Policy Groups

Overview

This article explains the procedure for creating and editing access policy groups for administrators who perform initial configuration and operational management of Access Control.

Notes

  1. The content of this article is based on product specifications as of October 2026 and is subject to change without notice.
  2. Global administrator privileges for Access Control are required to check the actual screens and change settings.
  3. For information on how to access the administration screen, refer to the following article.
    [Access Control] How to Log in to the Administration
  4. Changes take effect immediately, but they will be used for user access control from the next login onward.

Procedure

You can experience the actual screen behavior using the demo screen from the link below.
Access Control｜Access Control Settings Demo Tour (External Link)

Access Control settings demo tour screen

  1. In the left menu of the Access Control administration screen, go to ［Access Settings］－［Access Policy Groups］.

    Screen for selecting Access Settings in the left menu of the Access Control administration screen

  2. Click ［Add］ in the upper-right corner of the screen, or select one of the existing access policy groups.

    Screen for selecting the Add button or a group on the access policy group list screen

  3. Enter or edit each item, then click ［Save］ or ［Apply Changes］ in the lower-right corner of the screen.
    ※ For descriptions of each item, refer to the sections from Items (Basic Settings) onward.

    APG.png

Next Procedure

Assign an access policy group to users.
※ If an access policy group has already been assigned, no action is required.
For the assignment procedure, refer to the following article.
Assign Access Policy Group to Users (Modern View)

Items (Basic Settings)

The displayed items vary depending on your subscription.
For access policy templates, refer to the following article.
Access Control Create/Edit Access Policy Template

Name Description Notes
Display Name Name of the access policy group Up to 256 characters can be configured.
Authentication Cookie Expiration When ［Keep me logged in］ is selected on the login screen: The period during which the login state is maintained by cookies in the browser Unless the user logs out manually, the login state is maintained for the configured period even if the browser is restarted.
※ Up to 9,600 hours can be configured.
If left blank, the user will be logged out when the browser is closed.
※ The period for maintaining the login state using authentication cookies applies only between the browser and Access Control. If the connected service manages its own sessions, the Access Control login screen may be displayed due to session expiration on the service side, even within the cookie expiration period.
When ［Keep me logged in］ is not selected or is not displayed on the login screen: The maximum duration for which the user's login session is maintained If a page remains open beyond the configured period, you must log in again when navigating to another page.
※ If ［Keep me logged in］ is not selected or is not displayed, the user will be logged out when the browser is closed.
Conditions for Allowing Access
  • Always allow: Allows all access.
  • Allow under the following conditions: Allows access only from environments that match the conditional expression. (Select conditions from the access policy template)
  • Never allow: Does not allow any access.
Conditions for Allowing Legacy Authentication
  • Always allow: Allows all access through legacy authentication.
  • Allow under the following conditions: Allows only login requests using SAML ECP and Ws-Trust authentication under conditions that match the conditional expression. (Select conditions from the access policy template)
  • Never allow: Does not allow any access.
 Displayed only when integrated with Microsoft 365.
※ If legacy authentication is not used, we recommend configuring ［Never allow］ to ensure security.

Items (One-Time Password Settings)

Name Description Remarks
Conditions for Not Requiring OTP
  • Always Do Not Require OTP: OTP is not required.
  • Do Not Require OTP Under the Following Conditions: OTP is not required when accessing from an environment that matches the condition expression.
  • Always Require OTP: OTP is always required.
［Conditions for Allowing Changes to the OTP Shared Key］
  • Always Allow: Always allows changes to the OTP shared key.
  • Allow Under the Following Conditions: Allows changes to the OTP shared key only when accessing under conditions that match the condition expression (select conditions from the access policy template).
  • Never Allow: Never allows changes to the OTP shared key.

If both ［Conditions for Allowing OTP Notification Email Setup］ and this condition are set to ［Never Allow］, ［OTP (One-Time Password) Settings］ will not be displayed in the portal.

*This item does not apply to users with the administrator role. Administrators can configure OTP settings in the app from the portal at any time.
[Access Control] Configuration for Receiving OTP (One-Time Password) via Connected Application
［Conditions for Allowing OTP Notification Email Setup］
  • Always Allow: Always allows changes to the OTP notification email address.
  • Allow Under the Following Conditions: Allows changes to the OTP notification email address only when accessing under conditions that match the condition expression (select conditions from the access policy template).
  • Never Allow: Never allows changes to the OTP notification email address.
 If both ［Conditions for Allowing Changes to the OTP Shared Key］ and this condition are set to ［Never Allow］, ［OTP (One-Time Password) Settings］ will not be displayed on the user screen.

Items (Certificate Settings)

Name Description Remarks
［Conditions for Displaying Owned Device Certificates］
  • Always Allow: Always allows access to the client certificate screen.
  • Allow Under the Following Conditions: Allows access to the client certificate screen when accessing from an environment that matches the condition expression (select conditions from the access policy template).
  • Never Allow: Never allows access to the client certificate screen.
 If access is not allowed, the "Client Certificate" menu will not be displayed in the upper-right corner of the user portal.
［Conditions for Allowing Device Certificate Revocation］
  • Always Allow: Always allows device certificate revocation.
  • Allow Under the Following Conditions: Allows device certificate revocation when accessing from an environment that matches the condition expression (select conditions from the access policy template).
  • Never Allow: Never allows device certificate revocation.
 To use this feature, permission for ［Conditions for Displaying Owned Device Certificates］ is required.

Items (Secure Browser Settings)

Name Description Remarks
Conditions for Allowing Access to the Secure Browser Settings Screen
  • Always Allow: Always allows access to the Secure Browser settings screen
  • Allow Under the Following Conditions: Allows access to the Secure Browser settings screen when accessing from an environment that matches the condition expression (select conditions from the access policy template)
  • Never Allow: Never allows access to the Secure Browser settings screen
Conditions for Allowing Display of the Unread Email Check Settings Screen
  • Always Allow: Always allows access to the unread email check settings screen
  • Allow Under the Following Conditions: Allows access to the unread email check settings screen when accessing from an environment that matches the condition expression (select conditions from the access policy template)
  • Never Allow: Never allows access to the unread email check settings screen
Automatic Device Authentication Settings
  • Default: Uses the settings from the Access Control administration screen
  • Enabled: Automatically allows device authentication
  • Disabled: Administrator manually performs device authentication
 The default setting can be checked under ［Domain Settings］－［Secure Browser Related］－［General］－［Automatic Device Authentication］.
For the Procedure for administrators to manually perform device authentication when disabled, please refer to the following article.
Device Authentication for Secure Browser

Items (Allowed Service Providers)

In ［System］－［Service Provider Settings］ on the Access Control administration screen, configure whether to allow access to connected services.

Access can be controlled for each connected cloud service.
To allow access, enable the ［Allow］ switch and specify ［Conditions for Allowing Access］ and ［Conditions for Not Requiring OTP］ for each service.

許可するサービスプロバイダーの設定画面

Name Description Remarks
Conditions for Allowing Access
  • Always allow: Allow all access
  • Follow Access Policy Group settings: Allow access when the conditions of the Target Access Policy Group are met
  • Select from an Access Policy Template: Select conditions from an Access Policy Template
 Configure the conditions for allowing access for each integrated cloud service.
Conditions for Not Requiring OTP
  • Always require OTP: Always require OTP
  • Never require OTP: No OTP required
  • Follow Access Policy Group settings: Do not require OTP when the conditions of the Target Access Policy Group are met
  • Select from an Access Policy Template: Select conditions from an Access Policy Template
 Configure the conditions for requiring OTP for each integrated cloud service.

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.