Configure adaptive authentication policy-based multi-factor criteria

task australia Updated Sep 10, 2026 1 min read mfa-policy-criteria.md

Raw file servicenow.com

Use adaptive policies to determine which users must use two-step multi-factor (MFA) verification.

Before you begin

Role required: adaptive_auth_admin

Note:

If the default policy is Step-Up MFA Policy, users are shown with multi-factor authentication if the policy configured in Step-Up MFA Policy evaluates to true. Policy takes precedence over the user or role-based configuration.
MFA with SSO login is only available if glide.authenticate.mfa.with.multisso.enabled property is set to true.
You can navigate to the Authentication Policy record to Add or Edit the 'Policy Input(s)' to the referenced Policy field (Step-Up MFA Policy or Step-Down MFA Policy).

Procedure

Navigate to All > Adaptive Authentication > Auth Policy Contexts > MFA Context.

The MFA Context policy context record opens.

Select the default policy in the Default Policy field.

This selection determines how your instance uses the policy conditions to determine whether to require MFA.

Default Policy	Definition
Step-Up MFA Policy	Select to enforce MFA when the policy conditions defined in Step-Up MFA Policy evaluate to true.
Step-Down MFA Policy	Select to bypass MFA when the policy conditions defined in the Step-Down MFA Policy evaluate to true.

In the Step-Up MFA Policy field, select a policy to use with this context.
Select Update.

After saving the record, the Policy Input and Policy Conditions lists update to display the policy inputs and conditions associated with the policy selected in the Step-Up MFA Policy field.

51 lines · 2.3 KB Wrap lines

---
title: Configure adaptive authentication policy-based multi-factor criteria
description: Use adaptive policies to determine which users must use two-step multi-factor \(MFA\) verification.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/mfa-policy-criteria.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [MFA criteria, Configuring MFA, Multi-factor authentication, Authentication, Access Management]
---

# Configure adaptive authentication policy-based multi-factor criteria

Use adaptive policies to determine which users must use two-step multi-factor \(MFA\) verification.

## Before you begin

Role required: adaptive\_auth\_admin

**Note:**

- If the default policy is **Step-Up MFA Policy**, users are shown with multi-factor authentication if the policy configured in **Step-Up MFA Policy** evaluates to true. Policy takes precedence over the user or role-based configuration.
- MFA with SSO login is only available if `glide.authenticate.mfa.with.multisso.enabled` property is set to true.
- You can navigate to the Authentication Policy record to Add or Edit the 'Policy Input\(s\)' to the referenced Policy field \(**Step-Up MFA Policy** or **Step-Down MFA Policy**\).

## Procedure

1. Navigate to **All** &gt; **Adaptive Authentication** &gt; **Auth Policy Contexts** &gt; **MFA Context**.

The **MFA Context** policy context record opens.

2. Select the default policy in the **Default Policy** field.

This selection determines how your instance uses the policy conditions to determine whether to require MFA.

|Default Policy|Definition|
|--------------|----------|
|Step-Up MFA Policy|Select to enforce MFA when the policy conditions defined in **Step-Up MFA Policy** evaluate to true.|
|Step-Down MFA Policy|Select to bypass MFA when the policy conditions defined in the **Step-Down MFA Policy** evaluate to true.|

3. In the **Step-Up MFA Policy** field, select a policy to use with this context.

4. Select **Update**.

After saving the record, the **Policy Input** and **Policy Conditions** lists update to display the policy inputs and conditions associated with the policy selected in the **Step-Up MFA Policy** field.