Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Okta Provider
  4. API Docs
  5. AppSignonPolicyRule
Viewing docs for Okta v7.0.0
published on Friday, Sep 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-okta

okta.AppSignonPolicyRule

okta logo
Viewing docs for Okta v7.0.0
published on Friday, Sep 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-okta

    Manages a sign-on policy rules for the application.

    WARNING: This feature is only available as a part of the Identity Engine. Contact support for further information.

    WARNING: When managing multiple okta.AppSignonPolicyRule resources with concurrent operations, the Okta API may encounter concurrency issues. While this provider implements internal locking to prevent conflicts within a single Terraform process, you should use explicit dependsOn references between rules to ensure proper sequencing, especially when managing rule priorities.

    This resource allows you to create and configure a sign-on policy rule for the application. A default or ‘Catch-all Rule’ sign-on policy rule can be imported and managed as a custom rule. The only difference is that these fields are immutable and can not be managed: ’network_connection’, ’network_excludes’, ’network_includes’, ‘platform_include’, ‘custom_expression’, ‘device_is_registered’, ‘device_is_managed’, ‘users_excluded’, ‘users_included’, ‘groups_excluded’, ‘groups_included’, ‘user_types_excluded’ and ‘user_types_included’.

    Create AppSignonPolicyRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AppSignonPolicyRule(name: string, args: AppSignonPolicyRuleArgs, opts?: CustomResourceOptions);
    @overload
def AppSignonPolicyRule(resource_name: str,
                        args: AppSignonPolicyRuleArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def AppSignonPolicyRule(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        policy_id: Optional[str] = None,
                        network_excludes: Optional[Sequence[str]] = None,
                        user_types_included: Optional[Sequence[str]] = None,
                        custom_expression: Optional[str] = None,
                        device_assurances_included: Optional[Sequence[str]] = None,
                        device_is_managed: Optional[bool] = None,
                        device_is_registered: Optional[bool] = None,
                        factor_mode: Optional[str] = None,
                        groups_excluded: Optional[Sequence[str]] = None,
                        groups_included: Optional[Sequence[str]] = None,
                        inactivity_period: Optional[str] = None,
                        keep_me_signed_in: Optional[AppSignonPolicyRuleKeepMeSignedInArgs] = None,
                        network_includes: Optional[Sequence[str]] = None,
                        constraints: Optional[Sequence[str]] = None,
                        network_connection: Optional[str] = None,
                        name: Optional[str] = None,
                        office365_client_includes: Optional[Sequence[str]] = None,
                        platform_includes: Optional[Sequence[AppSignonPolicyRulePlatformIncludeArgs]] = None,
                        chains: Optional[Sequence[str]] = None,
                        priority: Optional[int] = None,
                        re_authentication_frequency: Optional[str] = None,
                        risk_score: Optional[str] = None,
                        status: Optional[str] = None,
                        type: Optional[str] = None,
                        user_types_excluded: Optional[Sequence[str]] = None,
                        access: Optional[str] = None,
                        users_excluded: Optional[Sequence[str]] = None,
                        users_included: Optional[Sequence[str]] = None)
    func NewAppSignonPolicyRule(ctx *Context, name string, args AppSignonPolicyRuleArgs, opts ...ResourceOption) (*AppSignonPolicyRule, error)
    public AppSignonPolicyRule(string name, AppSignonPolicyRuleArgs args, CustomResourceOptions? opts = null)
    public AppSignonPolicyRule(String name, AppSignonPolicyRuleArgs args)
public AppSignonPolicyRule(String name, AppSignonPolicyRuleArgs args, CustomResourceOptions options)

    type: okta:AppSignonPolicyRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "okta_app_signon_policy_rule" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AppSignonPolicyRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AppSignonPolicyRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AppSignonPolicyRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AppSignonPolicyRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AppSignonPolicyRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var appSignonPolicyRuleResource = new Okta.AppSignonPolicyRule("appSignonPolicyRuleResource", new()
{
    PolicyId = "string",
    NetworkExcludes = new[]
    {
        "string",
    },
    UserTypesIncluded = new[]
    {
        "string",
    },
    CustomExpression = "string",
    DeviceAssurancesIncluded = new[]
    {
        "string",
    },
    DeviceIsManaged = false,
    DeviceIsRegistered = false,
    FactorMode = "string",
    GroupsExcluded = new[]
    {
        "string",
    },
    GroupsIncluded = new[]
    {
        "string",
    },
    InactivityPeriod = "string",
    KeepMeSignedIn = new Okta.Inputs.AppSignonPolicyRuleKeepMeSignedInArgs
    {
        PostAuth = "string",
        PostAuthPromptFrequency = "string",
    },
    NetworkIncludes = new[]
    {
        "string",
    },
    Constraints = new[]
    {
        "string",
    },
    NetworkConnection = "string",
    Name = "string",
    Office365ClientIncludes = new[]
    {
        "string",
    },
    PlatformIncludes = new[]
    {
        new Okta.Inputs.AppSignonPolicyRulePlatformIncludeArgs
        {
            OsExpression = "string",
            OsType = "string",
            Type = "string",
        },
    },
    Chains = new[]
    {
        "string",
    },
    Priority = 0,
    ReAuthenticationFrequency = "string",
    RiskScore = "string",
    Status = "string",
    Type = "string",
    UserTypesExcluded = new[]
    {
        "string",
    },
    Access = "string",
    UsersExcluded = new[]
    {
        "string",
    },
    UsersIncluded = new[]
    {
        "string",
    },
});

    example, err := okta.NewAppSignonPolicyRule(ctx, "appSignonPolicyRuleResource", &okta.AppSignonPolicyRuleArgs{
	PolicyId: pulumi.String("string"),
	NetworkExcludes: pulumi.StringArray{
		pulumi.String("string"),
	},
	UserTypesIncluded: pulumi.StringArray{
		pulumi.String("string"),
	},
	CustomExpression: pulumi.String("string"),
	DeviceAssurancesIncluded: pulumi.StringArray{
		pulumi.String("string"),
	},
	DeviceIsManaged:    pulumi.Bool(false),
	DeviceIsRegistered: pulumi.Bool(false),
	FactorMode:         pulumi.String("string"),
	GroupsExcluded: pulumi.StringArray{
		pulumi.String("string"),
	},
	GroupsIncluded: pulumi.StringArray{
		pulumi.String("string"),
	},
	InactivityPeriod: pulumi.String("string"),
	KeepMeSignedIn: &okta.AppSignonPolicyRuleKeepMeSignedInArgs{
		PostAuth:                pulumi.String("string"),
		PostAuthPromptFrequency: pulumi.String("string"),
	},
	NetworkIncludes: pulumi.StringArray{
		pulumi.String("string"),
	},
	Constraints: pulumi.StringArray{
		pulumi.String("string"),
	},
	NetworkConnection: pulumi.String("string"),
	Name:              pulumi.String("string"),
	Office365ClientIncludes: pulumi.StringArray{
		pulumi.String("string"),
	},
	PlatformIncludes: okta.AppSignonPolicyRulePlatformIncludeArray{
		&okta.AppSignonPolicyRulePlatformIncludeArgs{
			OsExpression: pulumi.String("string"),
			OsType:       pulumi.String("string"),
			Type:         pulumi.String("string"),
		},
	},
	Chains: pulumi.StringArray{
		pulumi.String("string"),
	},
	Priority:                  pulumi.Int(0),
	ReAuthenticationFrequency: pulumi.String("string"),
	RiskScore:                 pulumi.String("string"),
	Status:                    pulumi.String("string"),
	Type:                      pulumi.String("string"),
	UserTypesExcluded: pulumi.StringArray{
		pulumi.String("string"),
	},
	Access: pulumi.String("string"),
	UsersExcluded: pulumi.StringArray{
		pulumi.String("string"),
	},
	UsersIncluded: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "okta_app_signon_policy_rule" "appSignonPolicyRuleResource" {
  lifecycle {
    create_before_destroy = true
  }
  policy_id                  = "string"
  network_excludes           = ["string"]
  user_types_included        = ["string"]
  custom_expression          = "string"
  device_assurances_included = ["string"]
  device_is_managed          = false
  device_is_registered       = false
  factor_mode                = "string"
  groups_excluded            = ["string"]
  groups_included            = ["string"]
  inactivity_period          = "string"
  keep_me_signed_in = {
    post_auth                  = "string"
    post_auth_prompt_frequency = "string"
  }
  network_includes          = ["string"]
  constraints               = ["string"]
  network_connection        = "string"
  name                      = "string"
  office365_client_includes = ["string"]
  platform_includes {
    os_expression = "string"
    os_type       = "string"
    type          = "string"
  }
  chains                      = ["string"]
  priority                    = 0
  re_authentication_frequency = "string"
  risk_score                  = "string"
  status                      = "string"
  type                        = "string"
  user_types_excluded         = ["string"]
  access                      = "string"
  users_excluded              = ["string"]
  users_included              = ["string"]
}

    var appSignonPolicyRuleResource = new AppSignonPolicyRule("appSignonPolicyRuleResource", AppSignonPolicyRuleArgs.builder()
    .policyId("string")
    .networkExcludes("string")
    .userTypesIncluded("string")
    .customExpression("string")
    .deviceAssurancesIncluded("string")
    .deviceIsManaged(false)
    .deviceIsRegistered(false)
    .factorMode("string")
    .groupsExcluded("string")
    .groupsIncluded("string")
    .inactivityPeriod("string")
    .keepMeSignedIn(AppSignonPolicyRuleKeepMeSignedInArgs.builder()
        .postAuth("string")
        .postAuthPromptFrequency("string")
        .build())
    .networkIncludes("string")
    .constraints("string")
    .networkConnection("string")
    .name("string")
    .office365ClientIncludes("string")
    .platformIncludes(AppSignonPolicyRulePlatformIncludeArgs.builder()
        .osExpression("string")
        .osType("string")
        .type("string")
        .build())
    .chains("string")
    .priority(0)
    .reAuthenticationFrequency("string")
    .riskScore("string")
    .status("string")
    .type("string")
    .userTypesExcluded("string")
    .access("string")
    .usersExcluded("string")
    .usersIncluded("string")
    .build());

    app_signon_policy_rule_resource = okta.AppSignonPolicyRule("appSignonPolicyRuleResource",
    policy_id="string",
    network_excludes=["string"],
    user_types_included=["string"],
    custom_expression="string",
    device_assurances_included=["string"],
    device_is_managed=False,
    device_is_registered=False,
    factor_mode="string",
    groups_excluded=["string"],
    groups_included=["string"],
    inactivity_period="string",
    keep_me_signed_in={
        "post_auth": "string",
        "post_auth_prompt_frequency": "string",
    },
    network_includes=["string"],
    constraints=["string"],
    network_connection="string",
    name="string",
    office365_client_includes=["string"],
    platform_includes=[{
        "os_expression": "string",
        "os_type": "string",
        "type": "string",
    }],
    chains=["string"],
    priority=0,
    re_authentication_frequency="string",
    risk_score="string",
    status="string",
    type="string",
    user_types_excluded=["string"],
    access="string",
    users_excluded=["string"],
    users_included=["string"])

    const appSignonPolicyRuleResource = new okta.AppSignonPolicyRule("appSignonPolicyRuleResource", {
    policyId: "string",
    networkExcludes: ["string"],
    userTypesIncluded: ["string"],
    customExpression: "string",
    deviceAssurancesIncluded: ["string"],
    deviceIsManaged: false,
    deviceIsRegistered: false,
    factorMode: "string",
    groupsExcluded: ["string"],
    groupsIncluded: ["string"],
    inactivityPeriod: "string",
    keepMeSignedIn: {
        postAuth: "string",
        postAuthPromptFrequency: "string",
    },
    networkIncludes: ["string"],
    constraints: ["string"],
    networkConnection: "string",
    name: "string",
    office365ClientIncludes: ["string"],
    platformIncludes: [{
        osExpression: "string",
        osType: "string",
        type: "string",
    }],
    chains: ["string"],
    priority: 0,
    reAuthenticationFrequency: "string",
    riskScore: "string",
    status: "string",
    type: "string",
    userTypesExcluded: ["string"],
    access: "string",
    usersExcluded: ["string"],
    usersIncluded: ["string"],
});

    type: okta:AppSignonPolicyRule
properties:
    access: string
    chains:
        - string
    constraints:
        - string
    customExpression: string
    deviceAssurancesIncluded:
        - string
    deviceIsManaged: false
    deviceIsRegistered: false
    factorMode: string
    groupsExcluded:
        - string
    groupsIncluded:
        - string
    inactivityPeriod: string
    keepMeSignedIn:
        postAuth: string
        postAuthPromptFrequency: string
    name: string
    networkConnection: string
    networkExcludes:
        - string
    networkIncludes:
        - string
    office365ClientIncludes:
        - string
    platformIncludes:
        - osExpression: string
          osType: string
          type: string
    policyId: string
    priority: 0
    reAuthenticationFrequency: string
    riskScore: string
    status: string
    type: string
    userTypesExcluded:
        - string
    userTypesIncluded:
        - string
    usersExcluded:
        - string
    usersIncluded:
        - string

    AppSignonPolicyRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AppSignonPolicyRule resource accepts the following input properties:

    PolicyId string
    ID of the policy
    Access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    Chains List<string>
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    Constraints List<string>
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    CustomExpression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    DeviceAssurancesIncluded List<string>
    List of device assurance IDs to include
    DeviceIsManaged bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    DeviceIsRegistered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    FactorMode string
    The number of factors required to satisfy this assurance level
    GroupsExcluded List<string>
    List of group IDs to exclude
    GroupsIncluded List<string>
    List of group IDs to include
    InactivityPeriod string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    KeepMeSignedIn AppSignonPolicyRuleKeepMeSignedIn
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    Name string
    Policy Rule Name
    NetworkConnection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    NetworkExcludes List<string>
    The zones to exclude
    NetworkIncludes List<string>
    The zones to include
    Office365ClientIncludes List<string>
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    PlatformIncludes List<AppSignonPolicyRulePlatformInclude>
    Priority int
    Priority of the rule.
    ReAuthenticationFrequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    RiskScore string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    Status string
    Status of the rule
    Type string
    The Verification Method type
    UserTypesExcluded List<string>
    Set of User Type IDs to exclude
    UserTypesIncluded List<string>
    Set of User Type IDs to include
    UsersExcluded List<string>
    Set of User IDs to exclude
    UsersIncluded List<string>
    Set of User IDs to include
    PolicyId string
    ID of the policy
    Access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    Chains []string
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    Constraints []string
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    CustomExpression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    DeviceAssurancesIncluded []string
    List of device assurance IDs to include
    DeviceIsManaged bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    DeviceIsRegistered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    FactorMode string
    The number of factors required to satisfy this assurance level
    GroupsExcluded []string
    List of group IDs to exclude
    GroupsIncluded []string
    List of group IDs to include
    InactivityPeriod string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    KeepMeSignedIn AppSignonPolicyRuleKeepMeSignedInArgs
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    Name string
    Policy Rule Name
    NetworkConnection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    NetworkExcludes []string
    The zones to exclude
    NetworkIncludes []string
    The zones to include
    Office365ClientIncludes []string
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    PlatformIncludes []AppSignonPolicyRulePlatformIncludeArgs
    Priority int
    Priority of the rule.
    ReAuthenticationFrequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    RiskScore string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    Status string
    Status of the rule
    Type string
    The Verification Method type
    UserTypesExcluded []string
    Set of User Type IDs to exclude
    UserTypesIncluded []string
    Set of User Type IDs to include
    UsersExcluded []string
    Set of User IDs to exclude
    UsersIncluded []string
    Set of User IDs to include
    policy_id string
    ID of the policy
    access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains list(string)
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints list(string)
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    custom_expression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    device_assurances_included list(string)
    List of device assurance IDs to include
    device_is_managed bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    device_is_registered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factor_mode string
    The number of factors required to satisfy this assurance level
    groups_excluded list(string)
    List of group IDs to exclude
    groups_included list(string)
    List of group IDs to include
    inactivity_period string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keep_me_signed_in object
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name string
    Policy Rule Name
    network_connection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    network_excludes list(string)
    The zones to exclude
    network_includes list(string)
    The zones to include
    office365_client_includes list(string)
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platform_includes list(object)
    priority number
    Priority of the rule.
    re_authentication_frequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    risk_score string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status string
    Status of the rule
    type string
    The Verification Method type
    user_types_excluded list(string)
    Set of User Type IDs to exclude
    user_types_included list(string)
    Set of User Type IDs to include
    users_excluded list(string)
    Set of User IDs to exclude
    users_included list(string)
    Set of User IDs to include
    policyId String
    ID of the policy
    access String
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains List<String>
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints List<String>
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    customExpression String
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    deviceAssurancesIncluded List<String>
    List of device assurance IDs to include
    deviceIsManaged Boolean
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    deviceIsRegistered Boolean
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factorMode String
    The number of factors required to satisfy this assurance level
    groupsExcluded List<String>
    List of group IDs to exclude
    groupsIncluded List<String>
    List of group IDs to include
    inactivityPeriod String
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keepMeSignedIn AppSignonPolicyRuleKeepMeSignedIn
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name String
    Policy Rule Name
    networkConnection String
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    networkExcludes List<String>
    The zones to exclude
    networkIncludes List<String>
    The zones to include
    office365ClientIncludes List<String>
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platformIncludes List<AppSignonPolicyRulePlatformInclude>
    priority Integer
    Priority of the rule.
    reAuthenticationFrequency String
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    riskScore String
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status String
    Status of the rule
    type String
    The Verification Method type
    userTypesExcluded List<String>
    Set of User Type IDs to exclude
    userTypesIncluded List<String>
    Set of User Type IDs to include
    usersExcluded List<String>
    Set of User IDs to exclude
    usersIncluded List<String>
    Set of User IDs to include
    policyId string
    ID of the policy
    access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains string[]
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints string[]
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    customExpression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    deviceAssurancesIncluded string[]
    List of device assurance IDs to include
    deviceIsManaged boolean
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    deviceIsRegistered boolean
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factorMode string
    The number of factors required to satisfy this assurance level
    groupsExcluded string[]
    List of group IDs to exclude
    groupsIncluded string[]
    List of group IDs to include
    inactivityPeriod string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keepMeSignedIn AppSignonPolicyRuleKeepMeSignedIn
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name string
    Policy Rule Name
    networkConnection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    networkExcludes string[]
    The zones to exclude
    networkIncludes string[]
    The zones to include
    office365ClientIncludes string[]
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platformIncludes AppSignonPolicyRulePlatformInclude[]
    priority number
    Priority of the rule.
    reAuthenticationFrequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    riskScore string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status string
    Status of the rule
    type string
    The Verification Method type
    userTypesExcluded string[]
    Set of User Type IDs to exclude
    userTypesIncluded string[]
    Set of User Type IDs to include
    usersExcluded string[]
    Set of User IDs to exclude
    usersIncluded string[]
    Set of User IDs to include
    policy_id str
    ID of the policy
    access str
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains Sequence[str]
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints Sequence[str]
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    custom_expression str
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    device_assurances_included Sequence[str]
    List of device assurance IDs to include
    device_is_managed bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    device_is_registered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factor_mode str
    The number of factors required to satisfy this assurance level
    groups_excluded Sequence[str]
    List of group IDs to exclude
    groups_included Sequence[str]
    List of group IDs to include
    inactivity_period str
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keep_me_signed_in AppSignonPolicyRuleKeepMeSignedInArgs
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name str
    Policy Rule Name
    network_connection str
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    network_excludes Sequence[str]
    The zones to exclude
    network_includes Sequence[str]
    The zones to include
    office365_client_includes Sequence[str]
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platform_includes Sequence[AppSignonPolicyRulePlatformIncludeArgs]
    priority int
    Priority of the rule.
    re_authentication_frequency str
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    risk_score str
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status str
    Status of the rule
    type str
    The Verification Method type
    user_types_excluded Sequence[str]
    Set of User Type IDs to exclude
    user_types_included Sequence[str]
    Set of User Type IDs to include
    users_excluded Sequence[str]
    Set of User IDs to exclude
    users_included Sequence[str]
    Set of User IDs to include
    policyId String
    ID of the policy
    access String
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains List<String>
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints List<String>
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    customExpression String
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    deviceAssurancesIncluded List<String>
    List of device assurance IDs to include
    deviceIsManaged Boolean
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    deviceIsRegistered Boolean
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factorMode String
    The number of factors required to satisfy this assurance level
    groupsExcluded List<String>
    List of group IDs to exclude
    groupsIncluded List<String>
    List of group IDs to include
    inactivityPeriod String
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keepMeSignedIn Property Map
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name String
    Policy Rule Name
    networkConnection String
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    networkExcludes List<String>
    The zones to exclude
    networkIncludes List<String>
    The zones to include
    office365ClientIncludes List<String>
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platformIncludes List<Property Map>
    priority Number
    Priority of the rule.
    reAuthenticationFrequency String
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    riskScore String
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status String
    Status of the rule
    type String
    The Verification Method type
    userTypesExcluded List<String>
    Set of User Type IDs to exclude
    userTypesIncluded List<String>
    Set of User Type IDs to include
    usersExcluded List<String>
    Set of User IDs to exclude
    usersIncluded List<String>
    Set of User IDs to include

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AppSignonPolicyRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    System bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    Id string
    The provider-assigned unique ID for this managed resource.
    System bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    id string
    The provider-assigned unique ID for this managed resource.
    system bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    id String
    The provider-assigned unique ID for this managed resource.
    system Boolean
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    id string
    The provider-assigned unique ID for this managed resource.
    system boolean
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    id str
    The provider-assigned unique ID for this managed resource.
    system bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    id String
    The provider-assigned unique ID for this managed resource.
    system Boolean
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy

    Look up Existing AppSignonPolicyRule Resource

    Get an existing AppSignonPolicyRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AppSignonPolicyRuleState, opts?: CustomResourceOptions): AppSignonPolicyRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access: Optional[str] = None,
        chains: Optional[Sequence[str]] = None,
        constraints: Optional[Sequence[str]] = None,
        custom_expression: Optional[str] = None,
        device_assurances_included: Optional[Sequence[str]] = None,
        device_is_managed: Optional[bool] = None,
        device_is_registered: Optional[bool] = None,
        factor_mode: Optional[str] = None,
        groups_excluded: Optional[Sequence[str]] = None,
        groups_included: Optional[Sequence[str]] = None,
        inactivity_period: Optional[str] = None,
        keep_me_signed_in: Optional[AppSignonPolicyRuleKeepMeSignedInArgs] = None,
        name: Optional[str] = None,
        network_connection: Optional[str] = None,
        network_excludes: Optional[Sequence[str]] = None,
        network_includes: Optional[Sequence[str]] = None,
        office365_client_includes: Optional[Sequence[str]] = None,
        platform_includes: Optional[Sequence[AppSignonPolicyRulePlatformIncludeArgs]] = None,
        policy_id: Optional[str] = None,
        priority: Optional[int] = None,
        re_authentication_frequency: Optional[str] = None,
        risk_score: Optional[str] = None,
        status: Optional[str] = None,
        system: Optional[bool] = None,
        type: Optional[str] = None,
        user_types_excluded: Optional[Sequence[str]] = None,
        user_types_included: Optional[Sequence[str]] = None,
        users_excluded: Optional[Sequence[str]] = None,
        users_included: Optional[Sequence[str]] = None) -> AppSignonPolicyRule
    func GetAppSignonPolicyRule(ctx *Context, name string, id IDInput, state *AppSignonPolicyRuleState, opts ...ResourceOption) (*AppSignonPolicyRule, error)
    public static AppSignonPolicyRule Get(string name, Input<string> id, AppSignonPolicyRuleState? state, CustomResourceOptions? opts = null)
    public static AppSignonPolicyRule get(String name, Output<String> id, AppSignonPolicyRuleState state, CustomResourceOptions options)
    resources:  _:    type: okta:AppSignonPolicyRule    get:      id: ${id}
    import {
  to = okta_app_signon_policy_rule.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    Chains List<string>
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    Constraints List<string>
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    CustomExpression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    DeviceAssurancesIncluded List<string>
    List of device assurance IDs to include
    DeviceIsManaged bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    DeviceIsRegistered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    FactorMode string
    The number of factors required to satisfy this assurance level
    GroupsExcluded List<string>
    List of group IDs to exclude
    GroupsIncluded List<string>
    List of group IDs to include
    InactivityPeriod string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    KeepMeSignedIn AppSignonPolicyRuleKeepMeSignedIn
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    Name string
    Policy Rule Name
    NetworkConnection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    NetworkExcludes List<string>
    The zones to exclude
    NetworkIncludes List<string>
    The zones to include
    Office365ClientIncludes List<string>
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    PlatformIncludes List<AppSignonPolicyRulePlatformInclude>
    PolicyId string
    ID of the policy
    Priority int
    Priority of the rule.
    ReAuthenticationFrequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    RiskScore string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    Status string
    Status of the rule
    System bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    Type string
    The Verification Method type
    UserTypesExcluded List<string>
    Set of User Type IDs to exclude
    UserTypesIncluded List<string>
    Set of User Type IDs to include
    UsersExcluded List<string>
    Set of User IDs to exclude
    UsersIncluded List<string>
    Set of User IDs to include
    Access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    Chains []string
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    Constraints []string
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    CustomExpression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    DeviceAssurancesIncluded []string
    List of device assurance IDs to include
    DeviceIsManaged bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    DeviceIsRegistered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    FactorMode string
    The number of factors required to satisfy this assurance level
    GroupsExcluded []string
    List of group IDs to exclude
    GroupsIncluded []string
    List of group IDs to include
    InactivityPeriod string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    KeepMeSignedIn AppSignonPolicyRuleKeepMeSignedInArgs
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    Name string
    Policy Rule Name
    NetworkConnection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    NetworkExcludes []string
    The zones to exclude
    NetworkIncludes []string
    The zones to include
    Office365ClientIncludes []string
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    PlatformIncludes []AppSignonPolicyRulePlatformIncludeArgs
    PolicyId string
    ID of the policy
    Priority int
    Priority of the rule.
    ReAuthenticationFrequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    RiskScore string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    Status string
    Status of the rule
    System bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    Type string
    The Verification Method type
    UserTypesExcluded []string
    Set of User Type IDs to exclude
    UserTypesIncluded []string
    Set of User Type IDs to include
    UsersExcluded []string
    Set of User IDs to exclude
    UsersIncluded []string
    Set of User IDs to include
    access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains list(string)
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints list(string)
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    custom_expression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    device_assurances_included list(string)
    List of device assurance IDs to include
    device_is_managed bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    device_is_registered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factor_mode string
    The number of factors required to satisfy this assurance level
    groups_excluded list(string)
    List of group IDs to exclude
    groups_included list(string)
    List of group IDs to include
    inactivity_period string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keep_me_signed_in object
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name string
    Policy Rule Name
    network_connection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    network_excludes list(string)
    The zones to exclude
    network_includes list(string)
    The zones to include
    office365_client_includes list(string)
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platform_includes list(object)
    policy_id string
    ID of the policy
    priority number
    Priority of the rule.
    re_authentication_frequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    risk_score string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status string
    Status of the rule
    system bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    type string
    The Verification Method type
    user_types_excluded list(string)
    Set of User Type IDs to exclude
    user_types_included list(string)
    Set of User Type IDs to include
    users_excluded list(string)
    Set of User IDs to exclude
    users_included list(string)
    Set of User IDs to include
    access String
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains List<String>
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints List<String>
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    customExpression String
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    deviceAssurancesIncluded List<String>
    List of device assurance IDs to include
    deviceIsManaged Boolean
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    deviceIsRegistered Boolean
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factorMode String
    The number of factors required to satisfy this assurance level
    groupsExcluded List<String>
    List of group IDs to exclude
    groupsIncluded List<String>
    List of group IDs to include
    inactivityPeriod String
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keepMeSignedIn AppSignonPolicyRuleKeepMeSignedIn
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name String
    Policy Rule Name
    networkConnection String
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    networkExcludes List<String>
    The zones to exclude
    networkIncludes List<String>
    The zones to include
    office365ClientIncludes List<String>
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platformIncludes List<AppSignonPolicyRulePlatformInclude>
    policyId String
    ID of the policy
    priority Integer
    Priority of the rule.
    reAuthenticationFrequency String
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    riskScore String
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status String
    Status of the rule
    system Boolean
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    type String
    The Verification Method type
    userTypesExcluded List<String>
    Set of User Type IDs to exclude
    userTypesIncluded List<String>
    Set of User Type IDs to include
    usersExcluded List<String>
    Set of User IDs to exclude
    usersIncluded List<String>
    Set of User IDs to include
    access string
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains string[]
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints string[]
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    customExpression string
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    deviceAssurancesIncluded string[]
    List of device assurance IDs to include
    deviceIsManaged boolean
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    deviceIsRegistered boolean
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factorMode string
    The number of factors required to satisfy this assurance level
    groupsExcluded string[]
    List of group IDs to exclude
    groupsIncluded string[]
    List of group IDs to include
    inactivityPeriod string
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keepMeSignedIn AppSignonPolicyRuleKeepMeSignedIn
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name string
    Policy Rule Name
    networkConnection string
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    networkExcludes string[]
    The zones to exclude
    networkIncludes string[]
    The zones to include
    office365ClientIncludes string[]
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platformIncludes AppSignonPolicyRulePlatformInclude[]
    policyId string
    ID of the policy
    priority number
    Priority of the rule.
    reAuthenticationFrequency string
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    riskScore string
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status string
    Status of the rule
    system boolean
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    type string
    The Verification Method type
    userTypesExcluded string[]
    Set of User Type IDs to exclude
    userTypesIncluded string[]
    Set of User Type IDs to include
    usersExcluded string[]
    Set of User IDs to exclude
    usersIncluded string[]
    Set of User IDs to include
    access str
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains Sequence[str]
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints Sequence[str]
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    custom_expression str
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    device_assurances_included Sequence[str]
    List of device assurance IDs to include
    device_is_managed bool
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    device_is_registered bool
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factor_mode str
    The number of factors required to satisfy this assurance level
    groups_excluded Sequence[str]
    List of group IDs to exclude
    groups_included Sequence[str]
    List of group IDs to include
    inactivity_period str
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keep_me_signed_in AppSignonPolicyRuleKeepMeSignedInArgs
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name str
    Policy Rule Name
    network_connection str
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    network_excludes Sequence[str]
    The zones to exclude
    network_includes Sequence[str]
    The zones to include
    office365_client_includes Sequence[str]
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platform_includes Sequence[AppSignonPolicyRulePlatformIncludeArgs]
    policy_id str
    ID of the policy
    priority int
    Priority of the rule.
    re_authentication_frequency str
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    risk_score str
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status str
    Status of the rule
    system bool
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    type str
    The Verification Method type
    user_types_excluded Sequence[str]
    Set of User Type IDs to exclude
    user_types_included Sequence[str]
    Set of User Type IDs to include
    users_excluded Sequence[str]
    Set of User IDs to exclude
    users_included Sequence[str]
    Set of User IDs to include
    access String
    Allow or deny access based on the rule conditions: ALLOW or DENY
    chains List<String>
    Authentication method chains. Only supports 5 items in the array. Each chain can support maximum 3 steps. To be used only with verification method type AUTH_METHOD_CHAIN.
    constraints List<String>
    An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
    customExpression String
    This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
    deviceAssurancesIncluded List<String>
    List of device assurance IDs to include
    deviceIsManaged Boolean
    If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
    deviceIsRegistered Boolean
    If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
    factorMode String
    The number of factors required to satisfy this assurance level
    groupsExcluded List<String>
    List of group IDs to exclude
    groupsIncluded List<String>
    List of group IDs to include
    inactivityPeriod String
    The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
    keepMeSignedIn Property Map
    Controls the post-authentication Keep Me Signed In (KMSI) prompt. Requires the KMSI feature to be enabled on the Okta org.
    name String
    Policy Rule Name
    networkConnection String
    Network selection mode: ANYWHERE, ZONE, ONNETWORK, or OFFNETWORK.
    networkExcludes List<String>
    The zones to exclude
    networkIncludes List<String>
    The zones to include
    office365ClientIncludes List<String>
    Set of Office 365 Client IDs to include. Only available with Office 365 applications. Valid values include WEB, MODERN_AUTH, ACTIVE_SYNC, AAD_JOIN, CERT_BASED_AUTH.
    platformIncludes List<Property Map>
    policyId String
    ID of the policy
    priority Number
    Priority of the rule.
    reAuthenticationFrequency String
    The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session. Cannot be set if reauthenticateIn is set in one or more entries of chains.
    riskScore String
    The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
    status String
    Status of the rule
    system Boolean
    Often the Catch-all Rule this rule is the system (default) rule for its associated policy
    type String
    The Verification Method type
    userTypesExcluded List<String>
    Set of User Type IDs to exclude
    userTypesIncluded List<String>
    Set of User Type IDs to include
    usersExcluded List<String>
    Set of User IDs to exclude
    usersIncluded List<String>
    Set of User IDs to include

    Supporting Types

    AppSignonPolicyRuleKeepMeSignedIn, AppSignonPolicyRuleKeepMeSignedInArgs

    PostAuth string
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    PostAuthPromptFrequency string
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).
    PostAuth string
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    PostAuthPromptFrequency string
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).
    post_auth string
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    post_auth_prompt_frequency string
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).
    postAuth String
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    postAuthPromptFrequency String
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).
    postAuth string
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    postAuthPromptFrequency string
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).
    post_auth str
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    post_auth_prompt_frequency str
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).
    postAuth String
    Whether the post-authentication KMSI flow is allowed. Valid values: ALLOWED, NOT_ALLOWED.
    postAuthPromptFrequency String
    How often the post-auth prompt is presented, as an ISO-8601 duration (e.g. PT168H).

    AppSignonPolicyRulePlatformInclude, AppSignonPolicyRulePlatformIncludeArgs

    OsExpression string
    Only available with OTHER OS type
    OsType string
    Type string
    OsExpression string
    Only available with OTHER OS type
    OsType string
    Type string
    os_expression string
    Only available with OTHER OS type
    os_type string
    type string
    osExpression String
    Only available with OTHER OS type
    osType String
    type String
    osExpression string
    Only available with OTHER OS type
    osType string
    type string
    os_expression str
    Only available with OTHER OS type
    os_type str
    type str
    osExpression String
    Only available with OTHER OS type
    osType String
    type String

    Import

    $ pulumi import okta:index/appSignonPolicyRule:AppSignonPolicyRule example <policy_id>/<rule_id>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Okta pulumi/pulumi-okta
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the okta Terraform Provider.
    okta logo
    Viewing docs for Okta v7.0.0
    published on Friday, Sep 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-okta

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial