[Access Control] How to Require an OTP (One-Time Password) When Administrators Sign In

Overview

This article explains how administrators who configure one-time passwords (OTPs) for Access Control administrator logins can require an OTP (one-time password) in addition to an ID and password.

Notes

1. The content of this article is based on product specifications as of October 2026 and is subject to change without notice.
2. When you perform this Procedure, all users belonging to the configured access policy group will be required to enter an OTP at login. Be sure to configure OTP for all Target users before starting operation.
3. To prepare for situations where you cannot enter an OTP, such as losing your mobile device, we recommend storing emergency OTP tokens.
   ※ For information about issuing emergency OTPs, refer to the "Use an Emergency OTP Token" section in the article below.
   [Access Control] OTP Issuance Methods and Expiration Period
4. If the access policies for administrators and users are the same, configuring OTP will require OTP for login by all users to whom the Target policy is applied.
   Change the administrator access policy according to your requirements.
   [Access Control] Create / Edit Access Policy Group
   Assign Access Policy Group to Users (Modern View)
5. Making OTP mandatory for users with administrator privileges is automatically enforced regardless of the OTP setting (enabled / disabled) of the access policy group assigned to the user.

Procedure

1. From the administration console, navigate to ［Access Settings］－［Access Policy Groups］.

   

2. Check the Target policy, then perform one of the following procedures depending on whether an administrator policy exists.
   ※ If ［Do not require OTP conditions］ is set to ［Always require OTP］ or ［Do not require OTP under the following conditions］ in the policy settings, OTP has already been configured, so this Procedure is not required.

   

   If an administrator access policy group exists
   This is the procedure for modifying an existing access policy. Perform this if initial setup has been completed.

   If an administrator access policy group does not exist
   This is the procedure for configuring a new access policy. Perform this if initial setup has not been completed.

If an administrator access policy group exists

1. Open the administrator access policy group and confirm that the settings for ［Conditions for Allowing OTP App Setup］ and ［Conditions for Allowing OTP Notification Email Setup］ are one of the following.

   • ［Always Allow］
   • ［Allow Under the Following Conditions］ and access from the current IP is permitted

   ※ If ［Always Deny］ is selected, change it to ［Always Allow］ and click ［Change］.
   ※ If your security policy restricts OTP setup to either the OTP app or email, allow only the corresponding setting.
   ［Conditions for Allowing OTP App Setup］: Allow OTP setup using the OTP app
   ［Conditions for Allowing OTP Notification Email Setup］: Allow OTP setup through email notifications

   

2. Select ［User Portal］ from the menu in the upper-right corner of the administration screen.

   

3. Click ［OTP (One-Time Password) Settings］ from the menu in the upper-right corner of the portal screen to configure OTP.
   ※ For details on the configuration procedure, refer to the following articles.

   • [Access Control] Configuration for Receiving OTP (One-Time Password) via Connected Application
   • [Access Control] Configuration for Receiving OTP (One-Time Password) via Email

   

4. Return to the administration screen and issue an emergency OTP token for the administrator account on the user edit screen.
   ※ If OTP setup fails, logging in with an emergency OTP will be required.
   Be sure to issue one and keep a record of it.

   • ［OTP］－［Emergency OTP Token］: "Add New"
     ※ For emergency OTP, refer to "Use an Emergency OTP Token" in the following article.
     [Access Control] OTP Issuance Methods and Expiration Period

   

5. Edit the administrator access policy group.
   ※ For details on the editing Procedure, refer to the following article.
   [Access Control] Create / Edit Access Policy Group
   Configure the settings as follows.

   • ［Conditions for Not Requiring OTP］: Always require OTP

   

6. Log out from the Access Control portal screen.
7. Confirm that you can log in to the Access Control administration screen using OTP with an administrator account.
   ※ For the login image, refer to the following article.
   [Access Control] Login Image Using One-Time Password

If an administrator access policy group does not exist

1. Create a new administrator access policy group in the Access Control administration screen.
   ※ For details on the creation Procedure, refer to the following article.
   [Access Control] Create / Edit Access Policy Group
   Configure the settings as follows, then click ［Save］.

   • ［Display Name］: "Administrator Access Rule," etc.
     ※ Set any display name.
   • ［Conditions for Allowing Access］: Configure an access policy template in accordance with your security policy.
     1. [Access Control] Create/Edit IP Sets
        ※ Only when performing IP control, use this Procedure to create a group containing the IP addresses to be allowed access.
     2. Access Control Create/Edit Access Policy Template
     3. [Access Control] Create / Edit Access Policy Group

     4. Assign Access Policy Group to Users (Modern View)

        Example access template settings

        ※ Assume that an IP address group named "internal-ip" has been created in advance, containing internal IP addresses.
        ・ Allow access using IP addresses only: @internal-ip@
        ・Internal network → allow login using IP addresses; external network → allow login using certificates: @internal-ip@ or cert:any
        ・Internal network → allow login using IP addresses; external network → allow login using Secure Browser: @internal-ip@ or hsb:true

   • ［Conditions for Not Requiring OTP］: Never require OTP
     ※ If you make OTP mandatory before configuring it, you will no longer be able to log in. Please note.
   • ［Conditions for Allowing OTP App Setup］: Always Allow
   • ［Conditions for Allowing OTP Notification Email Setup］: Always allow
   • ［Allowed Service Providers］: Select all

   ※ If your organization's security policy limits OTP configuration to either an OTP application or email, allow only the applicable setting.

   

   

2. Assign the created access policy group to the administrator.
   ※ For details on the assignment procedure, refer to the following article.
   Assign Access Policy Group to Users (Modern View)
   On the user edit screen, configure the following items.

   • ［Access Policy］－［Access Policy Group］: Select the access policy group created in Procedure 1.
   • ［OTP］－［Emergency OTP Token］: "Add New"
     ※ If OTP configuration fails, you will be unable to log in. Be sure to issue and save an emergency OTP token.
     ※ For emergency OTPs, refer to "Use an Emergency OTP Token" in the following article.
     [Access Control] OTP Issuance Methods and Expiration Period

   

3. Select ［User Portal］ from the menu in the upper-right corner of the administration screen.

   

4. From the menu in the upper-right corner of the Access Control portal screen, click ［OTP (One-Time Password) Settings］ to configure OTP.
   ※ For details on the configuration procedure, refer to the following articles.

   • [Access Control] Configuration for Receiving OTP (One-Time Password) via Connected Application
   • [Access Control] Configuration for Receiving OTP (One-Time Password) via Email

   

5. Return to the administration screen and configure OTP for the administrator access policy group.
   ※ For details on the creation procedure, refer to the following article.
   [Access Control] Create / Edit Access Policy Group
   Configure the settings as shown below, then click ［Apply Changes］.

   • ［Conditions for Not Requiring OTP］: Never require OTP → Always require OTP

   

6. Log out from the Access Control portal screen.
7. Confirm that you can log in to the Access Control administration screen using OTP with an administrator account.
   ※ For the login image, refer to the following article.
   [Access Control] Login Image Using One-Time Password

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.