Skip to main content
日本語 简体中文 繁體中文

[Access Control] Creating and Editing Access Policy Groups

Overview

This article explains the procedure for creating and editing access policy groups for administrators who perform initial setup and operational management of Access Control.

Notes

  1. The content of this article is based on product specifications as of October 2026 and may be changed without notice.
  2. Global administrator privileges for Access Control are required to check the actual screens and modify settings.
  3. For information on how to access the administration screen, please refer to the following article.
    [Access Control] How to Log in to the Administration
  4. Changes take effect immediately, but they will be used for user access control from the next login onward.

Procedure

Using the link below, you can experience the actual screen flow in the demo tour.
Access Control | Access Control Settings Demo Tour (External Link)

Access Control access control settings demo tour screen

  1. In the left menu of the Access Control administration screen, go to ［Access Settings］－［Access Policy Groups］.

    Screen for selecting Access Settings from the left menu of the Access Control administration screen

  2. Click ［Add］ in the upper-right corner of the screen, or select one of the existing access policy groups.

    Screen for selecting the Add button or a group on the access policy group list screen

  3. Enter or edit each item, then click ［Save］ or ［Apply Changes］ in the lower-right corner of the screen.
    ※ For descriptions of each item, see the sections from Items (Basic Settings) onward.

    APG.png

Next Steps

Assign an access policy group to users.
※ If an access policy group has already been assigned, no action is required.
For the assignment procedure, please refer to the following article.
[Access Control] Assigning Access Policy Groups to Users

Items (Basic Settings)

The displayed items vary depending on your contract.
For access policy templates, please refer to the following article.
Access Control Create/Edit Access Policy Template

Name Description Remarks
Display Name Name of the access policy group Up to 256 characters can be set.
Authentication Cookie Expiration When ［Keep me signed in］ is selected on the login screen: The period during which the login state is retained using cookies in the browser Unless the user logs out manually, the login state is retained for the configured period even if the browser is restarted.
※ You can configure up to 9,600 hours.
If left blank, you will be logged out when the browser is closed.
※ The login state retention period using authentication cookies applies only between the browser and Access Control. If the connected service manages its own sessions, the Access Control login screen may be displayed due to the service session expiring even within the cookie expiration period.
When ［Keep me signed in］ is not selected or is not displayed on the login screen: The maximum retention period for the user's login session If a single page remains open beyond the configured period, you must log in again when navigating to another page.
※ When ［Keep me signed in］ is not selected or is not displayed, you will be logged out when the browser is closed.
Conditions for Allowing Access
  • Always allow: Allows all access.
  • Allow under the following conditions: Allows access only from environments that match the condition expression. (Select conditions from an access policy template)
  • Never allow: Does not allow any access.
Conditions for Allowing Legacy Authentication
  • Always allow: Allows all access using legacy authentication.
  • Allow under the following conditions: Allows only login requests using SAML ECP and Ws-Trust authentication under conditions that match the condition expression. (Select conditions from an access policy template)
  • Never allow: Does not allow any access.
 Displayed only when integrated with Microsoft 365.
※ If legacy authentication is not used, we recommend configuring ［Never allow］ to ensure security.

Items (One-Time Password Settings)

Name Description Remarks
Conditions for not requiring OTP
  • Never require OTP: OTP will not be required.
  • Do not require OTP under the following conditions: OTP will not be required when accessing from an environment that matches the condition expression.
  • Always require OTP: OTP will always be required.
 －
Conditions for allowing OTP app setup
  • Always allow: Always allow changes to the OTP shared key.
  • Allow under the following conditions: Allow changes to the OTP shared key only when accessing under conditions that match the condition expression (select conditions from the access policy template).
  • Never allow: Never allow changes to the OTP shared key.

If both ［Conditions for allowing OTP notification email setup］ and this condition are set to ［Never allow］, ［OTP (One-Time Password) Settings］ will not be displayed in the portal.

*This item does not apply to users with the administrator role. Administrators can configure OTP settings in the app from the portal at any time.
[Access Control] Configuration for Receiving OTP (One-Time Password) via Connected Application
Conditions for allowing OTP notification email setup
  • Always allow: Always allow changes to the OTP notification email address.
  • Allow under the following conditions: Allow changes to the OTP notification email address only when accessing under conditions that match the condition expression (select conditions from the access policy template).
  • Never allow: Never allow changes to the OTP notification email address.
 If both ［Conditions for allowing OTP app setup］ and this condition are set to ［Never allow］, ［OTP (One-Time Password) Settings］ will not be displayed on the user screen.

Items (Certificate Settings)

Name Description Remarks
Conditions for displaying owned device certificates
  • Always allow: Always allow access to the client certificate screen.
  • Allow under the following conditions: Allow access to the client certificate screen when accessing from an environment that matches the condition expression (select conditions from the access policy template).
  • Never allow: Never allow access to the client certificate screen.
 If access is not allowed, the "Client Certificate" menu will not be displayed in the upper-right corner of the user portal.
Conditions for allowing device certificate revocation
  • Always allow: Always allow device certificate revocation.
  • Allow under the following conditions: Allow device certificate revocation when accessing from an environment that matches the condition expression (select conditions from the access policy template).
  • Never allow: Never allow device certificate revocation.
 To use this feature, permission for ［Conditions for displaying owned device certificates］ is required.

Items (Secure Browser Settings)

Name Description Remarks
Conditions for allowing access to the Secure Browser settings screen
  • Always allow: Always allow access to the Secure Browser settings screen
  • Allow under the following conditions: Allow access to the Secure Browser settings screen when accessing from an environment that matches the condition expression (select conditions from the access policy template)
  • Never allow: Never allow access to the Secure Browser settings screen
Conditions for allowing display of the unread email check settings screen
  • Always allow: Always allow access to the unread email check settings screen
  • Allow under the following conditions: Allow access to the unread email check settings screen when accessing from an environment that matches the condition expression (select conditions from the access policy template)
  • Never allow: Never allow access to the unread email check settings screen
Automatic device authentication settings
  • Default: Use the settings from the Access Control administration screen
  • Enabled: Automatically allow device authentication
  • Disabled: The administrator manually performs device authentication
 The default setting can be checked in ［Domain Settings］－［Secure Browser Related］－［General］－［Automatic Device Authentication］.
For the Procedure for administrators to manually perform device authentication when disabled, please refer to the following article.
Device Authentication for Secure Browser

Items (Allowed Service Providers)

In ［System］－［Service Provider Settings］ on the Access Control administration screen, configure whether to allow access to connected services.

Access can be controlled for each connected cloud service.
To allow access, enable the ［Allow］ switch and specify ［Conditions for allowing access］ and ［Conditions for not requiring OTP］ for each service.

Allowed service provider settings screen

Name Description Remarks
Conditions for Allowing Access
  • Always allow: Allows all access
  • Follow the access policy group settings: Allows access when the conditions of the Target access policy group are met
  • Select from access policy templates: Select conditions from an access policy template
 Configure the conditions for allowing access for each connected cloud service.
Conditions for Not Requiring OTP
  • Always require OTP: Always requires OTP
  • Never require OTP: Does not require OTP
  • Follow the access policy group settings: Allows access when the conditions of the Target access policy group are met
  • Select from access policy templates: Select conditions from an access policy template
 Configure the conditions for requiring OTP for each connected cloud service.

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.