Overview
This article introduces the procedure for customers implementing Access Control to configure the Condition to allow access and accessible services.
Notes
- The content of this article is based on product specifications as of October 2026 and may be changed without notice thereafter.
- Global Admin privileges for Access Control are required to perform this task.
-
For information on how to access the Administration, see the following article.
[Access Control] How to Log in to the Administration - Changes take effect immediately, but they will be used for user access control from the next Login onward.
Reference Information
You can experience how the actual screens work using the demo screen from the link below.
Access Control｜Access Control Settings Demo Tour （External Link）
Procedure
Create Access Policy Template
An Access policy template is a reusable template that consolidates access control conditions. It is used to configure access control.
-
In the left menu of the Access Control Administration, go to [Access Control] - [Access policy template].
-
Check the following policies that are configured by default.
For details, see “How to Configure Access Policy Templates by Requirement” below.
How to Configure Access Policy Templates by Requirement
OTP (one-time password) is configured in the “Access policy group,” so there are no settings for it in this procedure.
A. Restrict by location: 【Global IP Address and OTP Control】
This is configured by default.
Creation is complete once you add the IP addresses to be specified as control conditions to “IP Sets.”
| Item | Details | Description |
| ID | The setting value of the Access policy template used in the “Access policy group” |
Configured as “apt_0.” The ID cannot be changed later. |
| Name | Name of the Access policy template |
Configured as “Global IP.” Enter a Name of 256 characters or fewer. |
| Condition to allow access | Expression for the Condition to allow access |
The following IP Sets are specified as allowed conditions by default.
The configuration is complete once you add the allowed IP addresses to this IP Set. |
B. Restrict by device: 【Certificate Control】
Configured by default.
Please see the details below.
| Item | Details | Description |
| ID | The configuration value of the Access policy template used in the "Access policy group" |
Configured as "apt_1". It cannot be changed later. |
| Name | Name of the Access policy template |
Created as "Certificate". Enter a Name of 256 characters or fewer. |
| Condition to allow access | Expression for the Condition to allow access | "cert:any," which allows all certificates, is specified. |
C. Location or Device: 【Global IP Address Control and OTP Control】or 【Certificate Control】
Configured by default.
Creation is complete by adding the IP addresses to be specified as control conditions to the "IP Sets."
| Item | Details | Description |
| ID | The configuration value of the Access policy template used in the "Access policy group" |
Configured as "apt_2". It cannot be changed later. |
| Name | Name of the Access policy template |
Created as "Global IP or Certificate". Enter a Name of 256 characters or fewer. |
| Condition to allow access | Expression for the Condition to allow access |
In addition to certificates, the following IP Sets are specified as allowed conditions by default. The configuration is complete by adding the IP addresses to be allowed to this IP Set. |
※When Secure Browser is also used as a control condition in addition to the above policies
| Name |
Name of the Access policy template
|
Add a name that indicates that Secure Browser is also a control requirement, as necessary. |
| Condition to allow access | Expression for the Condition to allow access |
Add the following condition to the contents created in A, B, and C. or hsb:true (Example) @iplist@ or cert:any or hsb:true |
Create Access Policy Group
An Access policy group is a group that consolidates access control settings. Assign this group to each User to whom the same access control settings are applied.
-
Create an Access policy group to associate with the created Access policy template, or edit an existing Access policy group.
In the left menu of the Access Control Administration, go to [Access Control] - [Access policy group]. -
Select "DEFAULT," which has been assigned 0 as the Access policy group ID.
If different access permission conditions are required for each department or group, create the necessary number of Access policy groups.
After creating the first Access policy group, click [Add User] in the upper-right corner of the screen and repeat the procedure. - Configure each item from [Settings] to [HENNGE Secure Browser Settings].
The configuration differs depending on the information entered on the "HENNGE One Implementation Requirements Questionnaire" page. Please configure the settings according to your requirements, referring to "Access Policy Group Detailed Settings."
-
In addition to the conditions specified in the access policy template, you can add detailed settings.
The “Pattern” notation in the table corresponds as follows.
Configure the pattern according to your environment.
- Pattern A: Settings when using 【Global IP Address and OTP Control】
- Pattern B: Settings when using 【Certificate Control】
- Pattern C: Settings when using 【Global IP Address Control and OTP Control】 or 【Certificate Control】
Settings
| Name | Description and setting values | Description |
| Name |
The name of the Access policy group. (Example) For general user access (Global IP Address and OTP Control) |
You can set any name up to 256 characters. |
| Cookie lifespan |
Setting examples: 24→1 day / 168→1 week When [Remember this login] is checked on the Login screen: The duration for which the login status is retained by cookies in the browser |
Unless you Logout yourself, the login status will be retained for the configured duration even if you restart the browser.
※ Maximum: 9600 hours |
| When [Remember this login] is not checked / is not shown on the Login screen: The maximum duration for retaining the user's login session |
If the configured duration is exceeded while a page is open, you will be required to log in again when navigating to another page. ※ If [Remember this login] is not checked / is not shown, you will be logged out when the browser is closed. |
|
| Allow Self password reset | Never allow: Deny Self password reset |
This cannot be used when passwords are synchronized from Active Directory. The Email Address to be registered must not require Access Control authentication when accessed. This is because users are expected to be unable to log in to Microsoft 365 or Google Workspace when resetting their Password. |
Service Access Settings / OTP Settings
| Name | Description and setting values | Description |
| Condition to allow access |
Under ［Allow when］, select the access policy template corresponding to each pattern.
|
Only access from environments that meet the condition expression is allowed. |
| Condition to allow legacy authentication | Never allow: Deny all access | Shown only when integrated with Microsoft 365. |
| Skip OTP authentication |
Configure the setting corresponding to each pattern.
|
|
| Condition to change OTP app setup |
|
When using OTP, select “Always allow”. This enables users to configure OTP delivery to an app. |
| Condition to allow OTP notification email setup |
|
When using OTP, select “Always allow”. This enables users to configure OTP delivery to an app. |
Device Certificate Settings
| Name | Description and settings | Description |
| Condition to allow users to view their own Device Certificates | Always allow: Users can view the list of their own Device Certificates | This feature allows users to view the Device Certificates issued to them on the HENNGE One portal. |
| Condition to allow users to revoke Device Certificates | Never allow: Users cannot revoke their own Device Certificates | This feature allows end users to revoke their own Device Certificates. To use this feature, Condition to allow users to view their own Device Certificates must be permitted. |
HENNGE Secure Browser Settings
| Name | Description and settings | Description |
| Condition to access the secure browser control panel | Always allow: Access to the Secure Browser Settings screen is always permitted | If “To change this setting, change Allow access to Secure Browser menu in user portal to Follow access policy group in Domain Settings.” is displayed, navigate using the [Domain Settings] link, change Allow access to Secure Browser menu in user portal to Follow access policy group, and then configure this item again. |
| Condition to allow the Unread Email Check Settings screen to be displayed | Always allow: Access to the Unread Email Check Settings screen is always denied | － |
| Automatically authenticate | Unavailable: The Admin manually performs device authentication | － |
Configure Allowed services
-
Configure [Allowed services].
In the Access Control Administration, select [System] - [Edit Connected Service] to specify whether to allow access to each connected service. To grant access, enable the [Grant Permissions] switch and specify [Condition to allow access] and [Skip OTP authentication] for each service.
| Name | Description and settings | Description |
| Condition to allow access |
【When using common access control for all connected services】
【When using different access control for some connected services】 |
Configure the conditions for allowing access for each connected cloud service. 【When using different access control for some connected services】 refers, for example, to the following cases.
|
| Skip OTP authentication | Follow access policy group | OTP authentication is required under the same conditions as when logging in to Access Control. |
This completes the creation of the Access policy group.
Translation Disclaimer
This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.
In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.