Hello everyone. I'm Accountav and I'm a security customer success specialist. Welcome to this tool success Capsule on tool policy tools.00:06Here's our agenda for today. We'll start with an overview of dual policies, then move into dual policy tools. Next, we look at the configuration demo, and finally, we'll summarize the key takeaways.00:20Dual policies are an important part of controlling access because they allow organizations to define how users authenticate and under what conditions they can access protected applications.00:39The key idea is that authentication doesn't have to be the same for everyone. Based on your organization's security requirements, policies can help determine when stronger authentication is required, when access should be allowed.00:52Or when access should be restricted. Duo policies provide you with granular control over access and authentication. Policies allow you to consider the context around an access request rather than relying only on a user's identity.01:08This helps in applying the right level of security based on factors such as user, device or access context. At the same time, policies can help reduce unnecessary friction.01:30For trusted users while providing stronger controls when additional security is needed. So, the goal is really to achieve the right balance between security and user experience. One of the most important concepts to understand is.01:45It's a two oil policy hierarchy.02:05Tool provides different levels at which policies can be applied. Global, application, and group. A global policy provides broad organizational coverage. An application policy allows us to apply specific requirements to an individual application.02:08And group policies gives us more granular control for specific groups of users. Understanding this hierarchy is important because multiple policies can potentially apply to the same user.02:27Or application. As environments grow, managing policies can become increasingly complex. Admins may have multiple applications, user groups, and different authentication requirements.02:42Duo policy tools helps simplify this process by providing capabilities to create and edit policies, assign policies to targets, search and filter configurations, and verify the effective policy.03:00When creating a policy, admins can use the policy editor to configure the required settings. The settings tree provides an organized way to navigate through the available configuration options. You can create a new policy.03:19Or select an existing policy and modify its settings. This provides a structured and centralized way to manage your policy configuration.03:35Once a policy is created, the next step is making sure it's assigned to the correct target. From the application view, we can select an application and see the policy associated with it. From the group view, we can review policies assigned to specific user groups.03:51And the actions tab, the shortcut provides another way to quickly apply policies to multiple targets. So we are not only defining the policy, we are also making sure it reaches the right users and applications.04:10As the number of policies increases, finding the right configuration quickly becomes important. Duo provides search capabilities to help locate policies by policy name or group. We can also filter policies by type, which makes it easier to focus on application.04:31For group protections.04:51And finally, we can use the policy calculator to verify the configuration and understand what policy will actually apply. The policy calculator is especially useful when policy configurations become complex.04:53Instead of relying on trial and error or testing everything through a live user session, the calculator allows us to predict the access outcome. It can help us understand how different policies interact.05:15Identify potential conflicts and simulate the expected access behavior. This makes it particularly valuable for troubleshooting and pre deployment validation. The policy calculator determines the effective policy for a.05:29Specific user and application combination. The policy evaluation follows the priority shown here. Group, followed by application and then global policy. This allows admins to understand which policy takes precedence when multiple policies could apply.05:49Another benefit is that the lookup is non intrusive, so admins can investigate policy behavior without affecting active user sessions. In simple terms, it helps answer the question. For this specific user accessing this specific application.06:10What policy will actually apply? There are three particularly useful scenarios for the policy calculator. 1st is troubleshooting, e.g., understanding why a user received a particular MFA challenge.06:29Or why axis was denied?06:49Second is pre deployment testing. Before rolling out new policy broadly, admins can validate how it is expected to behave. And 3rd is conflict resolution, especially when a user belongs to multiple groups with different policy requirements.06:52So the calculator helps us move from guessing about policy behavior to actually understanding the expected outcome. Now that we've covered the concepts, let's move into the configuration demo.07:11Let's take a look at how we can access and manage policies directly from the dual admin panel. Here at the left side from the navigation menu, I'm gonna go in policies, and I'm gonna click on this policies option.07:32This is the central location where we can create and manage our dual policies. On this page, we can see the policies configured in the environment, including the global policy and any custom policies that have been created.07:49Let's check out the global policy. Global policy provides the baseline configuration and applies across the dual environment unless a more specific policy takes precedence.08:07So as you can see here, new user policy, authentication policy, user location, all of it have some kind of configuration, and that is like the baseline for all the users accessing all applications.08:22So apart from the custom call policies that are configured here, if nothing matches these policies, then the global policies are going to be applied for all those users.08:43Let's check some custom policies now. If I go into complete passwordless, we can click the policy name and then open the policy editor and review its configuration. So now I'm in complete passwordless, right? So the main setting here would.08:57The authentication methods, there are NO other methods selected. You only have passwordless authentication and SSO selected for platform authenticator, roaming authenticator to mobile push, which explains why this is called complete passwordless policy.09:17Let's explore some other custom policies now. I'm going to select higher security. Now once I'm inside this policy editor, you'll notice that the policy settings are organized into different sections on the left hand side.09:41As you can see here for this particular policy, we have all the highest security options, right? So new user policy is going to be block access, authentication policy is going to be enforced MFA and so on.09:59Yeah also provides additional context while we are configuring these settings. So as you can see here, there is a link to documentation.10:16Where this part of policy would be explained, which all groups have been applied to, and we also have a section for what does this protect against and what does to recommend, which is going to be very easy for the admins because they don't have to rely only on the existing knowledge.10:33Which of every policy setting.10:52There is also another dependencies and warning section sometimes that you can see here for options such as operating systems. As you see here, the dependencies and warnings are shown.10:57Highlighted with respect to Duo desktop. This helps admins make more informed decisions before saving a configuration. All types of advanced settings are very clear right in the policy tab.11:14So you don't have to go to any other section within the admin panel. So this is really moving policy configuration from simply selecting settings to having more context around why we might want to select a particular setting.11:31Now let's look at where this policy is actually being applied. A policy by itself isn't enough. We also need to understand its assignments. Depending on the policy type, custom policies can be assigned to applications.11:53User groups and specific groups accessing an application. So here we have the names, we have the applications and groups that all those policies are tied up to. All those roles that are selected.12:08Can be summarized in this summary. You have the timestamps, and we can also go directly into the applications properties and look at the policy section. So if I.12:25I have to go here for complete passwordless application, right? Under the policy tab, application group policies, application policies, and user group policies all are attached here. So you can configure from here as well.12:40Now I'd like to show this actions tab, which has the options to edit, delete, duplicate, apply or unassigned policies. If we go and apply, you will see three sections here, application growth.13:02Policy, application policy, and user group policy.13:20That's the precedence this it's going to take if a user has multiple policies involved, right? So that's the hierarchy. The 1st would be application group policy. These are the highest.13:23Precedence policies listed here. Then you have the application policy, then comes the user group policy and remaining policy settings which are not mutual in these.13:40Policy sections would be the global policies at last. So when two policies configure the same setting, the higher precedence policy is going to win. And thus, this brings us to the most useful troubleshooting tool, the policy calculator.13:56Now I'm gonna navigate back to policies and I'm gonna select policy calculator. As you can see here, you have two options to select the users that are configured in your environment and the respective applications.14:15The policy calculator was designed specifically to make it easier to understand how multiple security policies come together. So instead of manually looking through this particular user for this particular application, I'm just going to select it here in the calculator.14:33And it's going to show me all the options of how it actually got the proceedings of all the policies. And the types of policies are also color coded, so it becomes visually very convenient for us to locate all types of policies.14:53It gives us a visibility into which policy each individual role came from. So here, the risk based policies is something different because it's a custom policy, right? So all applications and groups that are tied would be listed here.15:13All the rules that are mentioned would be listed here and you get an easy access of the groups that are tied up to this policy for this particular user. So we know for this XYZ user.15:30We have the remembered devices for risk based policies configured. Let's take another example now. Let's say I select this application.15:46Because we have three precedences here, right? So I'm gonna select one user, respective application. And as you see here, you have the precedence number, right? So application.16:05Would win 1st because that is the hierarchy that Duo follows. So risk based policies, and then you have the user group policy, which is the risk based policies for Duo Okta Sync Group, and then the remaining settings would be from global policy.16:19Becomes very useful when you are looking out for any kind of troubleshooting settings or scenarios where you want to find out for this user what kind of authentication is being hit with respect to global policies and custom policies.16:43Plus this gives a role by role view of access decision. So we are not just seeing the final answer, we are getting visibility into how Duo arrived at that answer. Let's take another example.17:00Example now. I'm selecting this user and I'm keeping this application same because here we have two types of policies again application and global.17:15So say, let's say a user contacts the help desk, right? And says I'm being asked for MFA when I wasn't expecting it. So, when you look at the settings, you know that application group policy, application policy is tied up for this user.17:32And the risk based policies would hit 1st because it is in precedence for global policy. That is how this policy calculator is very effective because we look at the relevant authentication rules and identify what.17:51Which policy is responsible for the behavior? Subsequently, the same approach works in opposite situation. So say I am going to show another user and another application.18:11So if another user says I was expecting MFA, but I was allowed to access the application without it. So now we know this particular user has just the plain basic global policies, NO custom policies attached.18:31So, for, for global policy, they don't have any restrictions for user location, for browsers, authorized networks or anonymous networks. So this particular user is not going to.18:48Get MFA for those settings because there are NO custom policies attached to this user for accessing one password SSO application, right? So we can again use this calculator to identify such effective policy settings and determine which role of.19:04Is responsible. Does this is even more beneficial more than just troubleshooting, right? Because we can also use it to verify policy changes before or after making configuration updates and understand how those changes affect a particular user and application.19:24Now there is another scenario where this calculator can be particularly useful. I'm going to showcase another user here and let's.19:46Select dual Central as the application. Now imagine we've created some new policies, right? What safe trusted endpoints policy and dual central posture policy.20:01For a specific user group. Now the policy calculator allows us to see what the effective policy will look like for the user. So now you know trusted endpoints, you have trusted endpoints roles under devices.20:16And you have specific authentication methods and these applications and groups are involved with this particular policy. Let's check the dual central posture policy. You have the dual desktop and device health, specifically listed here.20:31We can then validate these new policy settings, whether they are producing the intended result, right? So if something doesn't look right, if you have, if you've, if you need to edit some rules which you think you had, but you you want to expect another.20:54A type of behavior, then you can just go back to policies and then do the those do those settings before setting it for all your end users. So rather than relying on trial and error, we can use the calculator as a way to validate our policy design.21:14And increase confidence in our configuration. So as you see here, there are so many policies attached to this user, right? Multiple application group policies, user group policies. So in order of the proceedings listed here, you know that the trusted endpoints policy is going to be the.21:341st one that is going to get affected for this user, then the dual central posture policy, then high security risk based policies, and finally all the global policy settings.21:54That's it for the demo. Let's wrap up with our three key takeaways. 1st is enhanced security granularity. Duo policies allows you to define precise access.22:14Requirements and apply authentication controls that align with their security posture. Second, streamlined operational efficiency. Tools such as policy calculator, as we saw, simplify policy management and make it so much easier to understand and troubleshoot.22:32Complex configurations. And 3rd, optimize user experience. The goal isn't simply to add more authentication challenges. It's about using policy controls intelligently to balance strong security with a seamless user experience.22:51Thank you for taking the time to join me for this tool success capsule on dual policy tools.23:10
