platform / access policy
Decide every login by who, where, and when.
One policy engine behind every AuthNull component. Allow the login, ask for MFA, or deny it, based on user, group, OU, source machine, and time of day.
Example login path. j.doe from the Finance group signs in from ws-114. At 17:45 the policy engine allows it. At 18:01 it needs MFA, and the login completes after the push is approved. The service account svc-backup signing in from ws-114 is denied and never reaches the domain controller.
Overview
One rule set decides every login, by who, where, when, and which machine.
- Does
Decides allow, MFA, or deny for every login.
From who is signing in, which group or OU they’re in, where from, at what time, and on which machine. MFA goes to AuthNull Authenticator, Duo, or Okta.
- Replaces
All-or-nothing MFA.
And Entra Conditional Access for on-prem AD, which it doesn’t reach.
- Needs
Nothing new.
It’s the policy engine already behind every component: DC Sensor, DB agent, RADIUS Bridge, and Gateway.
This page names what the Granular policy blocks on the AD and Database pages already do.
Conditions
Every condition you need, in one rule.
Condition builder
Stack user, group, host, and time in one rule. Each condition you add can change the outcome.
- ifgroup is Finance group
- andtime is after 18:00
- thenMFA required
Group and OU scope
Point a rule at AD groups, single users, or a whole OU, and see who it covers.
- OU=Engineering212 users
- OU=Finance148 users · in scope
- OU=Sales96 users
Time and location
Ask for more when the context is riskier, such as a login after working hours.
- j.doe at17:59Allow
- j.doe at18:01MFA required
Service account fence
Pin service accounts to the machines they run on. Anywhere else, they’re denied.
- svc-backup frombackup-01Allow
- svc-backup fromws-114Deny
Policy playground
Change the context. Watch the decision.
Pick who is signing in, from where, and when. The result updates live.
Login
Decision
j.doe · ws-114 · 18:30
MFA required
Same user and a known machine, but outside working hours, so the engine asks for a push.
Rule 5 of 6 · After-hours access
- 1Deny a service account that signs in from any machine other than its own.not a service account
- 2Allow svc-backup when it signs in from backup-01.not a service account
- 3Ask Domain Admins for MFA on every login.not in domain admins
- 4Ask for MFA when the machine isn’t one AuthNull knows.the machine is known
- 5Ask the Finance group for MFA before 08:00 or after 18:00.decides
- 6Allow everything else.not read
Sample rules for illustration. Your policies use your own groups, OUs, and hosts.
Compliance
Evidence for your auditors
Every decision is logged with the rule that made it, so you can show where MFA applies and why.
| Framework | Requires | AuthNull evidence |
|---|---|---|
| CMMCIA.L2-3.5.3 | MFA for privileged and network access. | Policy decisions · Auth logs |
| PCI DSS 4.08.4.2 | MFA for all access into the cardholder data environment. | Scoped MFA policies · Auth logs |
| Cyber insuranceQuestionnaires | MFA on admin and remote access, as insurers ask. | Admin MFA rules · RADIUS MFA |
AuthNull supports evidence collection for these controls. It does not certify compliance on its own.
See how your policies would look.
Walk through your AD groups, hosts, and service accounts with our team.