Access Control - Create a New Access Policy Group – HENNGE One Help Center

Target

Administrators who perform initial setup and operational management of HENNGE Access Control

Purpose

Explains the procedure for creating a new Access Policy Group in HENNGE Access Control.

Notes

This article is based on product specifications as of November 2024 and is subject to change without notice.
Administrator permissions for HENNGE Access Control are required for actual screen verification and configuration changes.
For instructions on accessing the administration screen, please refer to the following article:
Access Control Accessing the Administration Screen

Procedure

1. Access the [Access Control] - [Access Policy Group] in the left menu of the HENNGE Access Control administration screen.

2. Click [Add] in the upper right of the Access Policy Group screen.

3. Configure each item and click [Save].
※ Descriptions of each item are provided at the bottom of this article.

4. Assign the created Access Policy Group to users.
For assignment instructions, please refer to the following article:
Assigning Access Policy Groups to Users (Modern view)

Items (Base Configuration)

※ The displayed items may vary depending on the contract.
For information on Access Policy Templates, please refer to the following article:
Access Control Creating a New Access Policy Template

Name	Description	Notes
Display Name	Name of the Access Policy Group	Can be set up to 256 characters.
Authentication Cookie Expiration	If [Keep me logged in] is checked on the login screen: Time to keep the login status using cookies in the browser	Except when manually logging out, the login status will be maintained within the set time even if the browser is restarted, etc. ※ Can be set up to a maximum of 9600 hours. If left blank, logging out will occur when the browser is closed.
Authentication Cookie Expiration	If [Keep me logged in] is not checked or displayed on the login screen: Maximum retention time for a user's login session	If the set time is exceeded while continuously opening one page, logging in will be required again upon page transition. ※ If [Keep me logged in] is not checked or displayed, logging out will occur when the browser is closed.
Conditions for Allowing Access	Always allow: Allow all access Allow when conditions are met: Allow access only from environments that meet the condition (select conditions from the Access Policy Template) Never allow: Disallow all access
Conditions for Allowing Legacy Authentication	Always allow: Allow all access using legacy authentication Allow when conditions are met: Allow only login requests using SAML ECP and Ws-Trust authentication that meet the specified conditions (select conditions from the Access Policy Template) Never allow: Disallow all access	Displayed only when integrated with Microsoft 365.

Items (One-Time Password Settings)

Name	Description	Notes
Conditions for not requiring OTP	Always allow OTP to be skipped: Does not require OTP Allow OTP to be skipped when the following conditions are met: Does not require OTP when accessed from environments that meet the conditions Always require OTP: Always requires OTP
Conditions for allowing OTP shared key changes	Always allow: Always allow OTP shared key changes Allow when the following conditions are met: Allow OTP shared key changes only when accessed under specific conditions (select conditions from the Access Policy template) Never allow: Never allow OTP shared key changes	If you set the conditions for allowing OTP notification email address changes and these conditions are both set to "Never allow," the "OTP (One-Time Password) Settings" will not be displayed on the user screen.
Conditions for allowing OTP notification email address changes	Always allow: Always allow OTP notification email address changes Allow when the following conditions are met: Allow OTP notification email address changes only when accessed under specific conditions (select conditions from the Access Policy template) Never allow: Never allow OTP notification email address changes	If you set the conditions for allowing OTP shared key changes to "Never allow," the "OTP (One-Time Password) Settings" will not be displayed on the user screen.

Item (Certificate Settings)

Name	Description	Notes
Conditions for displaying owned device certificates	Always allow: Always allow access to the client certificate screen Allow when the following conditions are met: Allow access to the client certificate screen when accessed from environments that meet the conditions (select conditions from the Access Policy template) Never allow: Access to the client certificate screen is never allowed	If access is not allowed, the "Client Certificate" menu will not be displayed in the upper right corner of the user portal.
Conditions for allowing device certificate revocation	Always allow: Always allow device certificate revocation Allow when the following conditions are met: Allow device certificate revocation when accessed from environments that meet the conditions (select conditions from the Access Policy template) Never allow: Device certificate revocation is never allowed	To use this feature, "Conditions for displaying owned device certificates" must be allowed.

Item (HENNGE Secure Browser Settings)

Name	Description	Notes
Conditions for Allowing Access to Secure Browser Settings Screen	Always allow: Always allow access to the Secure Browser settings screen Allow when the following conditions are met: Allow access to the Secure Browser settings screen when accessed from environments that meet the conditions (select conditions from the Access Policy template) Never allow: Access to the Secure Browser settings screen is never allowed
Conditions for Allowing Display of Unread Email Check Settings Screen	Always allow: Always allow access to the Unread Check settings screen Allow when the following conditions are met: Allow access to the Unread Check settings screen when accessed from environments that meet the conditions (select conditions from the Access Policy template) Never allow: Access to the Unread Check settings screen is never allowed
Automatic Device Authentication Settings	Default: Use the settings in the Access Control Administration screen Active: Automatically allow device authentication Inactive: Manual device authentication by the administrator	You can check the default settings in [Domain Settings] - [Secure Browsers Related] - [General] - [Automatic Device Authentication]. For the procedure of manual device authentication when inactive, please refer to the following article. Device Authentication for Secure Browsers

Items (Allowed Service Providers)

Set whether to allow access to services connected in the HENNGE Access Control Administration screen [System] - [Connected Services] or not.
※ Access to connected services with a checkmark will be allowed.