Use Location Filter Post Authentication Context

---
title: Use Location Filter Post Authentication Context
description: Use the location filter criteria created in the Post Authentication Context.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/use-lf-post-auth.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Use Location Filter criteria, Location filter, Filter criteria, Adaptive authentication, Authentication, Access Management]
---

# Use Location Filter Post Authentication Context

Use the location filter criteria created in the Post Authentication Context.

## Before you begin

Role required: adaptive\_auth\_admin

Plugin required: **Zero Trust - Location Based Access** \(`com.snc.zero_trust_location_access`\).

A Location Filter with the countries that you want to restrict access to the users based on the location must be created. For more information, see [Create location filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/create-location-filter-criteria.md).

## Procedure

1.  Navigate to **All** > **Adaptive Authentication** > **Auth Policy Context** > **Post Authentication Context**.

    When a policy is chosen in the post authentication policy context:

    -   Selecting the Deny access policy as the default policy allows the access to all users by default and only denies access when the policy conditions defined in the deny access policy evaluate to true.
    -   Selecting the Allow access policy as the default policy denies the access to all users by default and only allows access when the policy conditions defined in the allow access policy evaluate to true.
    The example shows how you can configure `itil` users with a condition to only access the instance from the specified location \(US\). And the `itil` users can’t log in from other countries.

    After users provide their credentials on the login page, you can choose the Allow Access and the associated policy \(Allow Access\) as the Post Authentication policy and specify the policy inputs and conditions.

2.  Select the information icon and then select **Open Record** to open the **Allow Policy** record.

    **Note:** The example described in this task is **Allow Policy**. You can also use **Deny Policy** and set the conditions accordingly to control logins.

3.  In the Allow Access Policy, under the Policy Inputs section, select **New**.

    \[Omitted image "edit-post-auth.png"\] Alt text: Add Post auth

4.  Add the Role Filter criteria and Location Filter criteria.

    1.  Add Role Filter criteria:

        -   Create Role Filter Input as `itil`.\[Omitted image "itil-post-auth.png"\] Alt text: Itil Post Auth
        -   Create Role Filter Condition and set it to `true`.\[Omitted image "itil-post-auth-condition.png"\] Alt text: Role condition
        For more information on how to create role filter criteria, see [Create role filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/create-role-filter-criteria.md).

    2.  Add Location Filter criteria:

        -   Create Location Filter Input. Add United States in the Locations.\[Omitted image "itil-post-auth-US.png"\] Alt text: Ading Location
        -   Create Location Filter Condition and set it to `true`.\[Omitted image "itil-post-auth-US-condition.png"\] Alt text: Location Filter Condition
        For more information on how to create location filter criteria, see [Create location filter criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/create-location-filter-criteria.md).

        The Allow Access Policy shows the Policy Inputs and Conditions that are created in the previous steps:

        -   Policy Inputs: itil, itil user from US
        -   Policy Conditions: itil user login, itil user from US condition.
        \[Omitted image "post-auth-policy-condition.png"\] Alt text: Policy Input and Conditions

        **Note:**

        -   In this example, the selection of true as a condition implies that the `itil` users logging from the configured country \(US\) can log in to the instance.
        -   If the condition is set to false, then the `itil` users from the configured country \(US\) won’t be able to log in to the instance and the other users won’t be able to log in to the instance.
5.  Select **Submit** or **Update** to update the Post Authentication Context.

    The `itil` users selecting the instance link, specifying their credentials and then logging in from outside the configured country \(US\) are displayed an error message about the access denial \(error message configured by their administrators on the policy properties page\).