Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Onelogin Provider
  4. API Docs
  5. Policies
Viewing docs for onelogin 1.5.0
published on Friday, Aug 28, 2026 by onelogin
Schema (JSON)
onelogin/terraform-provider-onelogin

onelogin.Policies

onelogin logo onelogin logo
Viewing docs for onelogin 1.5.0
published on Friday, Aug 28, 2026 by onelogin
Schema (JSON)
onelogin/terraform-provider-onelogin

    Manages a OneLogin security policy.

    A policy is one of two kinds, set by kind and fixed for the life of the policy:

    • A user policy governs how people sign in — passwords, MFA, lockout, session length, self-service password reset, the portal, and so on. Assign it to users through the policy_id on a group, or make it the account default in the OneLogin admin UI. Roles cannot carry a policy: OneLogin has no role-to-policy assignment.
    • An app policy governs a single application — whether opening it forces re-authentication, and how long that lasts.

    The two share one API resource, so most arguments belong to only one kind. Each argument below says which. Setting one on the wrong kind is refused during pulumi preview, before anything reaches OneLogin.

    Custom security policies are a licensed feature. If your plan does not include Custom Security Policies, creating one returns 406 Not Acceptable.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as onelogin from "@pulumi/onelogin";

const engineering = new onelogin.Policies("engineering", {
    name: "Engineering",
    kind: "user",
    minimumPasswordLength: 12,
    passwordExpirationDays: 90,
    passwordsRemembered: 5,
    passwordComplexityRequirements: 3,
    maximumInvalidLoginAttempts: 5,
    lockEffectiveMinutes: 15,
    otpAuthEnabled: true,
    mfaRegistrationEnabled: true,
    authenticationFactorIds: [
        12345,
        67890,
    ],
    sessionTimeoutByInactivityValue: 30,
    sessionTimeoutByInactivityUnit: 0,
    termsAndConditions: {
        enabled: true,
        content: "Access is monitored and logged.",
    },
});
const financeApp = new onelogin.Policies("finance_app", {
    name: "Finance app step-up",
    kind: "app",
    forceAuthn: true,
    appForceAuthnOffset: 60,
});
// An app policy takes effect through the app that uses it.
const finance = new onelogin.Apps("finance", {
    name: "Finance",
    connectorId: 108419,
    policyId: financeApp.policiesId,
});

    import pulumi
import pulumi_onelogin as onelogin

engineering = onelogin.Policies("engineering",
    name="Engineering",
    kind="user",
    minimum_password_length=12,
    password_expiration_days=90,
    passwords_remembered=5,
    password_complexity_requirements=3,
    maximum_invalid_login_attempts=5,
    lock_effective_minutes=15,
    otp_auth_enabled=True,
    mfa_registration_enabled=True,
    authentication_factor_ids=[
        12345,
        67890,
    ],
    session_timeout_by_inactivity_value=30,
    session_timeout_by_inactivity_unit=0,
    terms_and_conditions={
        "enabled": True,
        "content": "Access is monitored and logged.",
    })
finance_app = onelogin.Policies("finance_app",
    name="Finance app step-up",
    kind="app",
    force_authn=True,
    app_force_authn_offset=60)
# An app policy takes effect through the app that uses it.
finance = onelogin.Apps("finance",
    name="Finance",
    connector_id=108419,
    policy_id=finance_app.policies_id)

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/onelogin/onelogin"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := onelogin.NewPolicies(ctx, "engineering", &onelogin.PoliciesArgs{
			Name:                           pulumi.String("Engineering"),
			Kind:                           pulumi.String("user"),
			MinimumPasswordLength:          pulumi.Float64(12),
			PasswordExpirationDays:         pulumi.Float64(90),
			PasswordsRemembered:            pulumi.Float64(5),
			PasswordComplexityRequirements: pulumi.Float64(3),
			MaximumInvalidLoginAttempts:    pulumi.Float64(5),
			LockEffectiveMinutes:           pulumi.Float64(15),
			OtpAuthEnabled:                 pulumi.Bool(true),
			MfaRegistrationEnabled:         pulumi.Bool(true),
			AuthenticationFactorIds: pulumi.Float64Array{
				pulumi.Float64(12345),
				pulumi.Float64(67890),
			},
			SessionTimeoutByInactivityValue: pulumi.Float64(30),
			SessionTimeoutByInactivityUnit:  pulumi.Float64(0),
			TermsAndConditions: &onelogin.PoliciesTermsAndConditionsArgs{
				Enabled: pulumi.Bool(true),
				Content: pulumi.String("Access is monitored and logged."),
			},
		})
		if err != nil {
			return err
		}
		financeApp, err := onelogin.NewPolicies(ctx, "finance_app", &onelogin.PoliciesArgs{
			Name:                pulumi.String("Finance app step-up"),
			Kind:                pulumi.String("app"),
			ForceAuthn:          pulumi.Bool(true),
			AppForceAuthnOffset: pulumi.Float64(60),
		})
		if err != nil {
			return err
		}
		// An app policy takes effect through the app that uses it.
		_, err = onelogin.NewApps(ctx, "finance", &onelogin.AppsArgs{
			Name:        pulumi.String("Finance"),
			ConnectorId: pulumi.Float64(108419),
			PolicyId:    financeApp.PoliciesId,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Onelogin = Pulumi.Onelogin;

return await Deployment.RunAsync(() => 
{
    var engineering = new Onelogin.Policies("engineering", new()
    {
        Name = "Engineering",
        Kind = "user",
        MinimumPasswordLength = 12,
        PasswordExpirationDays = 90,
        PasswordsRemembered = 5,
        PasswordComplexityRequirements = 3,
        MaximumInvalidLoginAttempts = 5,
        LockEffectiveMinutes = 15,
        OtpAuthEnabled = true,
        MfaRegistrationEnabled = true,
        AuthenticationFactorIds = new[]
        {
            12345,
            67890,
        },
        SessionTimeoutByInactivityValue = 30,
        SessionTimeoutByInactivityUnit = 0,
        TermsAndConditions = new Onelogin.Inputs.PoliciesTermsAndConditionsArgs
        {
            Enabled = true,
            Content = "Access is monitored and logged.",
        },
    });

    var financeApp = new Onelogin.Policies("finance_app", new()
    {
        Name = "Finance app step-up",
        Kind = "app",
        ForceAuthn = true,
        AppForceAuthnOffset = 60,
    });

    // An app policy takes effect through the app that uses it.
    var finance = new Onelogin.Apps("finance", new()
    {
        Name = "Finance",
        ConnectorId = 108419,
        PolicyId = financeApp.PoliciesId,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.onelogin.Policies;
import com.pulumi.onelogin.PoliciesArgs;
import com.pulumi.onelogin.inputs.PoliciesTermsAndConditionsArgs;
import com.pulumi.onelogin.Apps;
import com.pulumi.onelogin.AppsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var engineering = new Policies("engineering", PoliciesArgs.builder()
            .name("Engineering")
            .kind("user")
            .minimumPasswordLength(12.0)
            .passwordExpirationDays(90.0)
            .passwordsRemembered(5.0)
            .passwordComplexityRequirements(3.0)
            .maximumInvalidLoginAttempts(5.0)
            .lockEffectiveMinutes(15.0)
            .otpAuthEnabled(true)
            .mfaRegistrationEnabled(true)
            .authenticationFactorIds(            
                12345.0,
                67890.0)
            .sessionTimeoutByInactivityValue(30.0)
            .sessionTimeoutByInactivityUnit(0.0)
            .termsAndConditions(PoliciesTermsAndConditionsArgs.builder()
                .enabled(true)
                .content("Access is monitored and logged.")
                .build())
            .build());

        var financeApp = new Policies("financeApp", PoliciesArgs.builder()
            .name("Finance app step-up")
            .kind("app")
            .forceAuthn(true)
            .appForceAuthnOffset(60.0)
            .build());

        // An app policy takes effect through the app that uses it.
        var finance = new Apps("finance", AppsArgs.builder()
            .name("Finance")
            .connectorId(108419.0)
            .policyId(financeApp.policiesId())
            .build());

    }
}

    resources:
  engineering:
    type: onelogin:Policies
    properties:
      name: Engineering
      kind: user
      minimumPasswordLength: 12
      passwordExpirationDays: 90
      passwordsRemembered: 5
      passwordComplexityRequirements: 3 # Lockout
      maximumInvalidLoginAttempts: 5
      lockEffectiveMinutes: 15 # MFA
      otpAuthEnabled: true
      mfaRegistrationEnabled: true
      authenticationFactorIds:
        - 12345
        - 67890
      sessionTimeoutByInactivityValue: 30
      sessionTimeoutByInactivityUnit: 0
      termsAndConditions:
        enabled: true
        content: Access is monitored and logged.
  financeApp:
    type: onelogin:Policies
    name: finance_app
    properties:
      name: Finance app step-up
      kind: app
      forceAuthn: true
      appForceAuthnOffset: 60
  # An app policy takes effect through the app that uses it.
  finance:
    type: onelogin:Apps
    properties:
      name: Finance
      connectorId: 108419
      policyId: ${financeApp.policiesId}

    Example coming soon!

    Applying a policy

    Creating a policy does not by itself apply it to anyone.

    • App policies are applied through the app: set policy_id on onelogin.Apps, onelogin.SamlApps or onelogin.OidcApps, as above.

      Unassign with policy_id = 0. Note that removing the argument does not unassign — it leaves the last value in place, because policy_id is computed as well as optional, which is what stops a configuration that never mentioned a policy from clearing one assigned in the admin UI.

    • User policies are applied by assigning them to a group, using policy_id on onelogin.Groups:

    import * as pulumi from "@pulumi/pulumi";
import * as onelogin from "@pulumi/onelogin";

const engineering = new onelogin.Policies("engineering", {
    name: "Engineering",
    kind: "user",
});
const engineeringGroups = new onelogin.Groups("engineering", {
    name: "Engineering",
    policyId: engineering.policiesId,
});

    import pulumi
import pulumi_onelogin as onelogin

engineering = onelogin.Policies("engineering",
    name="Engineering",
    kind="user")
engineering_groups = onelogin.Groups("engineering",
    name="Engineering",
    policy_id=engineering.policies_id)

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/onelogin/onelogin"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		engineering, err := onelogin.NewPolicies(ctx, "engineering", &onelogin.PoliciesArgs{
			Name: pulumi.String("Engineering"),
			Kind: pulumi.String("user"),
		})
		if err != nil {
			return err
		}
		_, err = onelogin.NewGroups(ctx, "engineering", &onelogin.GroupsArgs{
			Name:     pulumi.String("Engineering"),
			PolicyId: engineering.PoliciesId,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Onelogin = Pulumi.Onelogin;

return await Deployment.RunAsync(() => 
{
    var engineering = new Onelogin.Policies("engineering", new()
    {
        Name = "Engineering",
        Kind = "user",
    });

    var engineeringGroups = new Onelogin.Groups("engineering", new()
    {
        Name = "Engineering",
        PolicyId = engineering.PoliciesId,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.onelogin.Policies;
import com.pulumi.onelogin.PoliciesArgs;
import com.pulumi.onelogin.Groups;
import com.pulumi.onelogin.GroupsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var engineering = new Policies("engineering", PoliciesArgs.builder()
            .name("Engineering")
            .kind("user")
            .build());

        var engineeringGroups = new Groups("engineeringGroups", GroupsArgs.builder()
            .name("Engineering")
            .policyId(engineering.policiesId())
            .build());

    }
}

    resources:
  engineering:
    type: onelogin:Policies
    properties:
      name: Engineering
      kind: user
  engineeringGroups:
    type: onelogin:Groups
    name: engineering
    properties:
      name: Engineering
      policyId: ${engineering.policiesId}

    Example coming soon!

    Making a policy the account default is not manageable here; that is still set in the OneLogin admin UI.

    Create Policies Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Policies(name: string, args: PoliciesArgs, opts?: CustomResourceOptions);
    @overload
def Policies(resource_name: str,
             args: PoliciesArgs,
             opts: Optional[ResourceOptions] = None)

@overload
def Policies(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             kind: Optional[str] = None,
             admin_policy_id: Optional[float] = None,
             allow_add_company_app: Optional[bool] = None,
             allow_add_personal_app: Optional[bool] = None,
             app_force_authn_offset: Optional[float] = None,
             app_otp_offset: Optional[float] = None,
             app_otp_offset_enabled: Optional[bool] = None,
             authentication_factor_ids: Optional[Sequence[float]] = None,
             browser_cert_required: Optional[bool] = None,
             browser_pki_expiration: Optional[float] = None,
             disable_browser_password_manager: Optional[bool] = None,
             disable_protect_push_notifications: Optional[bool] = None,
             disable_protect_push_recovery: Optional[bool] = None,
             dynamic_blacklist_attributes: Optional[str] = None,
             enable_browser_extensions: Optional[bool] = None,
             enable_email_hint: Optional[bool] = None,
             enable_email_password_reset: Optional[bool] = None,
             enable_number_match: Optional[bool] = None,
             enable_password_change: Optional[bool] = None,
             enable_question_password_reset: Optional[bool] = None,
             enable_smart_access: Optional[bool] = None,
             enable_sms_password_reset: Optional[bool] = None,
             enable_system_use_notification: Optional[bool] = None,
             enable_unlock_via_password_reset: Optional[bool] = None,
             enforce_account_password_blacklist: Optional[bool] = None,
             enforce_compromised_credentials_check: Optional[bool] = None,
             euba_enabled: Optional[bool] = None,
             euba_risk_threshold: Optional[float] = None,
             facebook: Optional[bool] = None,
             force_authn: Optional[bool] = None,
             gdt_required: Optional[bool] = None,
             google: Optional[bool] = None,
             ignore_xff: Optional[bool] = None,
             invite_expiration_time_unit: Optional[float] = None,
             invite_expiration_time_value: Optional[float] = None,
             ip_addr_restriction: Optional[str] = None,
             linkedin: Optional[bool] = None,
             lock_effective_minutes: Optional[float] = None,
             maximum_invalid_login_attempts: Optional[float] = None,
             mfa_registration_enabled: Optional[bool] = None,
             minimum_password_length: Optional[float] = None,
             name: Optional[str] = None,
             new_portal_setting: Optional[str] = None,
             otp_auth_enabled: Optional[bool] = None,
             otp_config: Optional[float] = None,
             otp_security_token_expiration_days: Optional[float] = None,
             otp_trigger_condition: Optional[float] = None,
             password_complexity_requirements: Optional[float] = None,
             password_expiration_days: Optional[float] = None,
             password_redirect_enabled: Optional[bool] = None,
             password_redirect_message: Optional[str] = None,
             password_redirect_url: Optional[str] = None,
             passwords_remembered: Optional[float] = None,
             persistent_session_enabled: Optional[bool] = None,
             policies_id: Optional[str] = None,
             preferred_auth_state_machine: Optional[float] = None,
             profile_policy_id: Optional[float] = None,
             require_security_questions: Optional[bool] = None,
             reset_password_authentication_factor_ids: Optional[Sequence[float]] = None,
             secure_admin: Optional[bool] = None,
             secure_area_otp_timeout_minutes: Optional[float] = None,
             secure_profile: Optional[bool] = None,
             self_install_cert: Optional[bool] = None,
             session_timeout_by_fixed_time_unit: Optional[float] = None,
             session_timeout_by_fixed_time_value: Optional[float] = None,
             session_timeout_by_inactivity_unit: Optional[float] = None,
             session_timeout_by_inactivity_value: Optional[float] = None,
             session_timeout_minutes: Optional[float] = None,
             session_timeout_type: Optional[float] = None,
             smart_access_risk_threshold: Optional[float] = None,
             social_sign_in: Optional[bool] = None,
             system_use_notification: Optional[str] = None,
             terms_and_conditions: Optional[PoliciesTermsAndConditionsArgs] = None,
             third_party_device_trust: Optional[bool] = None,
             track_inactive_users: Optional[bool] = None,
             trusted_device_login_enabled: Optional[bool] = None,
             trusted_device_login_mfa_allowed: Optional[bool] = None,
             twitter: Optional[bool] = None,
             user_phone_update_allowed: Optional[bool] = None,
             voluntary_mfa_registration_enabled: Optional[bool] = None)
    func NewPolicies(ctx *Context, name string, args PoliciesArgs, opts ...ResourceOption) (*Policies, error)
    public Policies(string name, PoliciesArgs args, CustomResourceOptions? opts = null)
    public Policies(String name, PoliciesArgs args)
public Policies(String name, PoliciesArgs args, CustomResourceOptions options)

    type: onelogin:Policies
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "onelogin_policies" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args PoliciesArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args PoliciesArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args PoliciesArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args PoliciesArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args PoliciesArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var policiesResource = new Onelogin.Policies("policiesResource", new()
{
    Kind = "string",
    AdminPolicyId = 0.0,
    AllowAddCompanyApp = false,
    AllowAddPersonalApp = false,
    AppForceAuthnOffset = 0.0,
    AppOtpOffset = 0.0,
    AppOtpOffsetEnabled = false,
    AuthenticationFactorIds = new[]
    {
        0.0,
    },
    BrowserCertRequired = false,
    BrowserPkiExpiration = 0.0,
    DisableBrowserPasswordManager = false,
    DisableProtectPushNotifications = false,
    DisableProtectPushRecovery = false,
    DynamicBlacklistAttributes = "string",
    EnableBrowserExtensions = false,
    EnableEmailHint = false,
    EnableEmailPasswordReset = false,
    EnableNumberMatch = false,
    EnablePasswordChange = false,
    EnableQuestionPasswordReset = false,
    EnableSmartAccess = false,
    EnableSmsPasswordReset = false,
    EnableSystemUseNotification = false,
    EnableUnlockViaPasswordReset = false,
    EnforceAccountPasswordBlacklist = false,
    EnforceCompromisedCredentialsCheck = false,
    EubaEnabled = false,
    EubaRiskThreshold = 0.0,
    Facebook = false,
    ForceAuthn = false,
    GdtRequired = false,
    Google = false,
    IgnoreXff = false,
    InviteExpirationTimeUnit = 0.0,
    InviteExpirationTimeValue = 0.0,
    IpAddrRestriction = "string",
    Linkedin = false,
    LockEffectiveMinutes = 0.0,
    MaximumInvalidLoginAttempts = 0.0,
    MfaRegistrationEnabled = false,
    MinimumPasswordLength = 0.0,
    Name = "string",
    NewPortalSetting = "string",
    OtpAuthEnabled = false,
    OtpConfig = 0.0,
    OtpSecurityTokenExpirationDays = 0.0,
    OtpTriggerCondition = 0.0,
    PasswordComplexityRequirements = 0.0,
    PasswordExpirationDays = 0.0,
    PasswordRedirectEnabled = false,
    PasswordRedirectMessage = "string",
    PasswordRedirectUrl = "string",
    PasswordsRemembered = 0.0,
    PersistentSessionEnabled = false,
    PoliciesId = "string",
    PreferredAuthStateMachine = 0.0,
    ProfilePolicyId = 0.0,
    RequireSecurityQuestions = false,
    ResetPasswordAuthenticationFactorIds = new[]
    {
        0.0,
    },
    SecureAdmin = false,
    SecureAreaOtpTimeoutMinutes = 0.0,
    SecureProfile = false,
    SelfInstallCert = false,
    SessionTimeoutByFixedTimeUnit = 0.0,
    SessionTimeoutByFixedTimeValue = 0.0,
    SessionTimeoutByInactivityUnit = 0.0,
    SessionTimeoutByInactivityValue = 0.0,
    SessionTimeoutMinutes = 0.0,
    SessionTimeoutType = 0.0,
    SmartAccessRiskThreshold = 0.0,
    SocialSignIn = false,
    SystemUseNotification = "string",
    TermsAndConditions = new Onelogin.Inputs.PoliciesTermsAndConditionsArgs
    {
        Content = "string",
        Enabled = false,
    },
    ThirdPartyDeviceTrust = false,
    TrackInactiveUsers = false,
    TrustedDeviceLoginEnabled = false,
    TrustedDeviceLoginMfaAllowed = false,
    Twitter = false,
    UserPhoneUpdateAllowed = false,
    VoluntaryMfaRegistrationEnabled = false,
});

    example, err := onelogin.NewPolicies(ctx, "policiesResource", &onelogin.PoliciesArgs{
	Kind:                pulumi.String("string"),
	AdminPolicyId:       pulumi.Float64(0),
	AllowAddCompanyApp:  pulumi.Bool(false),
	AllowAddPersonalApp: pulumi.Bool(false),
	AppForceAuthnOffset: pulumi.Float64(0),
	AppOtpOffset:        pulumi.Float64(0),
	AppOtpOffsetEnabled: pulumi.Bool(false),
	AuthenticationFactorIds: pulumi.Float64Array{
		pulumi.Float64(0),
	},
	BrowserCertRequired:                pulumi.Bool(false),
	BrowserPkiExpiration:               pulumi.Float64(0),
	DisableBrowserPasswordManager:      pulumi.Bool(false),
	DisableProtectPushNotifications:    pulumi.Bool(false),
	DisableProtectPushRecovery:         pulumi.Bool(false),
	DynamicBlacklistAttributes:         pulumi.String("string"),
	EnableBrowserExtensions:            pulumi.Bool(false),
	EnableEmailHint:                    pulumi.Bool(false),
	EnableEmailPasswordReset:           pulumi.Bool(false),
	EnableNumberMatch:                  pulumi.Bool(false),
	EnablePasswordChange:               pulumi.Bool(false),
	EnableQuestionPasswordReset:        pulumi.Bool(false),
	EnableSmartAccess:                  pulumi.Bool(false),
	EnableSmsPasswordReset:             pulumi.Bool(false),
	EnableSystemUseNotification:        pulumi.Bool(false),
	EnableUnlockViaPasswordReset:       pulumi.Bool(false),
	EnforceAccountPasswordBlacklist:    pulumi.Bool(false),
	EnforceCompromisedCredentialsCheck: pulumi.Bool(false),
	EubaEnabled:                        pulumi.Bool(false),
	EubaRiskThreshold:                  pulumi.Float64(0),
	Facebook:                           pulumi.Bool(false),
	ForceAuthn:                         pulumi.Bool(false),
	GdtRequired:                        pulumi.Bool(false),
	Google:                             pulumi.Bool(false),
	IgnoreXff:                          pulumi.Bool(false),
	InviteExpirationTimeUnit:           pulumi.Float64(0),
	InviteExpirationTimeValue:          pulumi.Float64(0),
	IpAddrRestriction:                  pulumi.String("string"),
	Linkedin:                           pulumi.Bool(false),
	LockEffectiveMinutes:               pulumi.Float64(0),
	MaximumInvalidLoginAttempts:        pulumi.Float64(0),
	MfaRegistrationEnabled:             pulumi.Bool(false),
	MinimumPasswordLength:              pulumi.Float64(0),
	Name:                               pulumi.String("string"),
	NewPortalSetting:                   pulumi.String("string"),
	OtpAuthEnabled:                     pulumi.Bool(false),
	OtpConfig:                          pulumi.Float64(0),
	OtpSecurityTokenExpirationDays:     pulumi.Float64(0),
	OtpTriggerCondition:                pulumi.Float64(0),
	PasswordComplexityRequirements:     pulumi.Float64(0),
	PasswordExpirationDays:             pulumi.Float64(0),
	PasswordRedirectEnabled:            pulumi.Bool(false),
	PasswordRedirectMessage:            pulumi.String("string"),
	PasswordRedirectUrl:                pulumi.String("string"),
	PasswordsRemembered:                pulumi.Float64(0),
	PersistentSessionEnabled:           pulumi.Bool(false),
	PoliciesId:                         pulumi.String("string"),
	PreferredAuthStateMachine:          pulumi.Float64(0),
	ProfilePolicyId:                    pulumi.Float64(0),
	RequireSecurityQuestions:           pulumi.Bool(false),
	ResetPasswordAuthenticationFactorIds: pulumi.Float64Array{
		pulumi.Float64(0),
	},
	SecureAdmin:                     pulumi.Bool(false),
	SecureAreaOtpTimeoutMinutes:     pulumi.Float64(0),
	SecureProfile:                   pulumi.Bool(false),
	SelfInstallCert:                 pulumi.Bool(false),
	SessionTimeoutByFixedTimeUnit:   pulumi.Float64(0),
	SessionTimeoutByFixedTimeValue:  pulumi.Float64(0),
	SessionTimeoutByInactivityUnit:  pulumi.Float64(0),
	SessionTimeoutByInactivityValue: pulumi.Float64(0),
	SessionTimeoutMinutes:           pulumi.Float64(0),
	SessionTimeoutType:              pulumi.Float64(0),
	SmartAccessRiskThreshold:        pulumi.Float64(0),
	SocialSignIn:                    pulumi.Bool(false),
	SystemUseNotification:           pulumi.String("string"),
	TermsAndConditions: &onelogin.PoliciesTermsAndConditionsArgs{
		Content: pulumi.String("string"),
		Enabled: pulumi.Bool(false),
	},
	ThirdPartyDeviceTrust:           pulumi.Bool(false),
	TrackInactiveUsers:              pulumi.Bool(false),
	TrustedDeviceLoginEnabled:       pulumi.Bool(false),
	TrustedDeviceLoginMfaAllowed:    pulumi.Bool(false),
	Twitter:                         pulumi.Bool(false),
	UserPhoneUpdateAllowed:          pulumi.Bool(false),
	VoluntaryMfaRegistrationEnabled: pulumi.Bool(false),
})

    resource "onelogin_policies" "policiesResource" {
  lifecycle {
    create_before_destroy = true
  }
  kind                                     = "string"
  admin_policy_id                          = 0
  allow_add_company_app                    = false
  allow_add_personal_app                   = false
  app_force_authn_offset                   = 0
  app_otp_offset                           = 0
  app_otp_offset_enabled                   = false
  authentication_factor_ids                = [0]
  browser_cert_required                    = false
  browser_pki_expiration                   = 0
  disable_browser_password_manager         = false
  disable_protect_push_notifications       = false
  disable_protect_push_recovery            = false
  dynamic_blacklist_attributes             = "string"
  enable_browser_extensions                = false
  enable_email_hint                        = false
  enable_email_password_reset              = false
  enable_number_match                      = false
  enable_password_change                   = false
  enable_question_password_reset           = false
  enable_smart_access                      = false
  enable_sms_password_reset                = false
  enable_system_use_notification           = false
  enable_unlock_via_password_reset         = false
  enforce_account_password_blacklist       = false
  enforce_compromised_credentials_check    = false
  euba_enabled                             = false
  euba_risk_threshold                      = 0
  facebook                                 = false
  force_authn                              = false
  gdt_required                             = false
  google                                   = false
  ignore_xff                               = false
  invite_expiration_time_unit              = 0
  invite_expiration_time_value             = 0
  ip_addr_restriction                      = "string"
  linkedin                                 = false
  lock_effective_minutes                   = 0
  maximum_invalid_login_attempts           = 0
  mfa_registration_enabled                 = false
  minimum_password_length                  = 0
  name                                     = "string"
  new_portal_setting                       = "string"
  otp_auth_enabled                         = false
  otp_config                               = 0
  otp_security_token_expiration_days       = 0
  otp_trigger_condition                    = 0
  password_complexity_requirements         = 0
  password_expiration_days                 = 0
  password_redirect_enabled                = false
  password_redirect_message                = "string"
  password_redirect_url                    = "string"
  passwords_remembered                     = 0
  persistent_session_enabled               = false
  policies_id                              = "string"
  preferred_auth_state_machine             = 0
  profile_policy_id                        = 0
  require_security_questions               = false
  reset_password_authentication_factor_ids = [0]
  secure_admin                             = false
  secure_area_otp_timeout_minutes          = 0
  secure_profile                           = false
  self_install_cert                        = false
  session_timeout_by_fixed_time_unit       = 0
  session_timeout_by_fixed_time_value      = 0
  session_timeout_by_inactivity_unit       = 0
  session_timeout_by_inactivity_value      = 0
  session_timeout_minutes                  = 0
  session_timeout_type                     = 0
  smart_access_risk_threshold              = 0
  social_sign_in                           = false
  system_use_notification                  = "string"
  terms_and_conditions = {
    content = "string"
    enabled = false
  }
  third_party_device_trust           = false
  track_inactive_users               = false
  trusted_device_login_enabled       = false
  trusted_device_login_mfa_allowed   = false
  twitter                            = false
  user_phone_update_allowed          = false
  voluntary_mfa_registration_enabled = false
}

    var policiesResource = new Policies("policiesResource", PoliciesArgs.builder()
    .kind("string")
    .adminPolicyId(0.0)
    .allowAddCompanyApp(false)
    .allowAddPersonalApp(false)
    .appForceAuthnOffset(0.0)
    .appOtpOffset(0.0)
    .appOtpOffsetEnabled(false)
    .authenticationFactorIds(0.0)
    .browserCertRequired(false)
    .browserPkiExpiration(0.0)
    .disableBrowserPasswordManager(false)
    .disableProtectPushNotifications(false)
    .disableProtectPushRecovery(false)
    .dynamicBlacklistAttributes("string")
    .enableBrowserExtensions(false)
    .enableEmailHint(false)
    .enableEmailPasswordReset(false)
    .enableNumberMatch(false)
    .enablePasswordChange(false)
    .enableQuestionPasswordReset(false)
    .enableSmartAccess(false)
    .enableSmsPasswordReset(false)
    .enableSystemUseNotification(false)
    .enableUnlockViaPasswordReset(false)
    .enforceAccountPasswordBlacklist(false)
    .enforceCompromisedCredentialsCheck(false)
    .eubaEnabled(false)
    .eubaRiskThreshold(0.0)
    .facebook(false)
    .forceAuthn(false)
    .gdtRequired(false)
    .google(false)
    .ignoreXff(false)
    .inviteExpirationTimeUnit(0.0)
    .inviteExpirationTimeValue(0.0)
    .ipAddrRestriction("string")
    .linkedin(false)
    .lockEffectiveMinutes(0.0)
    .maximumInvalidLoginAttempts(0.0)
    .mfaRegistrationEnabled(false)
    .minimumPasswordLength(0.0)
    .name("string")
    .newPortalSetting("string")
    .otpAuthEnabled(false)
    .otpConfig(0.0)
    .otpSecurityTokenExpirationDays(0.0)
    .otpTriggerCondition(0.0)
    .passwordComplexityRequirements(0.0)
    .passwordExpirationDays(0.0)
    .passwordRedirectEnabled(false)
    .passwordRedirectMessage("string")
    .passwordRedirectUrl("string")
    .passwordsRemembered(0.0)
    .persistentSessionEnabled(false)
    .policiesId("string")
    .preferredAuthStateMachine(0.0)
    .profilePolicyId(0.0)
    .requireSecurityQuestions(false)
    .resetPasswordAuthenticationFactorIds(0.0)
    .secureAdmin(false)
    .secureAreaOtpTimeoutMinutes(0.0)
    .secureProfile(false)
    .selfInstallCert(false)
    .sessionTimeoutByFixedTimeUnit(0.0)
    .sessionTimeoutByFixedTimeValue(0.0)
    .sessionTimeoutByInactivityUnit(0.0)
    .sessionTimeoutByInactivityValue(0.0)
    .sessionTimeoutMinutes(0.0)
    .sessionTimeoutType(0.0)
    .smartAccessRiskThreshold(0.0)
    .socialSignIn(false)
    .systemUseNotification("string")
    .termsAndConditions(PoliciesTermsAndConditionsArgs.builder()
        .content("string")
        .enabled(false)
        .build())
    .thirdPartyDeviceTrust(false)
    .trackInactiveUsers(false)
    .trustedDeviceLoginEnabled(false)
    .trustedDeviceLoginMfaAllowed(false)
    .twitter(false)
    .userPhoneUpdateAllowed(false)
    .voluntaryMfaRegistrationEnabled(false)
    .build());

    policies_resource = onelogin.Policies("policiesResource",
    kind="string",
    admin_policy_id=float(0),
    allow_add_company_app=False,
    allow_add_personal_app=False,
    app_force_authn_offset=float(0),
    app_otp_offset=float(0),
    app_otp_offset_enabled=False,
    authentication_factor_ids=[float(0)],
    browser_cert_required=False,
    browser_pki_expiration=float(0),
    disable_browser_password_manager=False,
    disable_protect_push_notifications=False,
    disable_protect_push_recovery=False,
    dynamic_blacklist_attributes="string",
    enable_browser_extensions=False,
    enable_email_hint=False,
    enable_email_password_reset=False,
    enable_number_match=False,
    enable_password_change=False,
    enable_question_password_reset=False,
    enable_smart_access=False,
    enable_sms_password_reset=False,
    enable_system_use_notification=False,
    enable_unlock_via_password_reset=False,
    enforce_account_password_blacklist=False,
    enforce_compromised_credentials_check=False,
    euba_enabled=False,
    euba_risk_threshold=float(0),
    facebook=False,
    force_authn=False,
    gdt_required=False,
    google=False,
    ignore_xff=False,
    invite_expiration_time_unit=float(0),
    invite_expiration_time_value=float(0),
    ip_addr_restriction="string",
    linkedin=False,
    lock_effective_minutes=float(0),
    maximum_invalid_login_attempts=float(0),
    mfa_registration_enabled=False,
    minimum_password_length=float(0),
    name="string",
    new_portal_setting="string",
    otp_auth_enabled=False,
    otp_config=float(0),
    otp_security_token_expiration_days=float(0),
    otp_trigger_condition=float(0),
    password_complexity_requirements=float(0),
    password_expiration_days=float(0),
    password_redirect_enabled=False,
    password_redirect_message="string",
    password_redirect_url="string",
    passwords_remembered=float(0),
    persistent_session_enabled=False,
    policies_id="string",
    preferred_auth_state_machine=float(0),
    profile_policy_id=float(0),
    require_security_questions=False,
    reset_password_authentication_factor_ids=[float(0)],
    secure_admin=False,
    secure_area_otp_timeout_minutes=float(0),
    secure_profile=False,
    self_install_cert=False,
    session_timeout_by_fixed_time_unit=float(0),
    session_timeout_by_fixed_time_value=float(0),
    session_timeout_by_inactivity_unit=float(0),
    session_timeout_by_inactivity_value=float(0),
    session_timeout_minutes=float(0),
    session_timeout_type=float(0),
    smart_access_risk_threshold=float(0),
    social_sign_in=False,
    system_use_notification="string",
    terms_and_conditions={
        "content": "string",
        "enabled": False,
    },
    third_party_device_trust=False,
    track_inactive_users=False,
    trusted_device_login_enabled=False,
    trusted_device_login_mfa_allowed=False,
    twitter=False,
    user_phone_update_allowed=False,
    voluntary_mfa_registration_enabled=False)

    const policiesResource = new onelogin.Policies("policiesResource", {
    kind: "string",
    adminPolicyId: 0,
    allowAddCompanyApp: false,
    allowAddPersonalApp: false,
    appForceAuthnOffset: 0,
    appOtpOffset: 0,
    appOtpOffsetEnabled: false,
    authenticationFactorIds: [0],
    browserCertRequired: false,
    browserPkiExpiration: 0,
    disableBrowserPasswordManager: false,
    disableProtectPushNotifications: false,
    disableProtectPushRecovery: false,
    dynamicBlacklistAttributes: "string",
    enableBrowserExtensions: false,
    enableEmailHint: false,
    enableEmailPasswordReset: false,
    enableNumberMatch: false,
    enablePasswordChange: false,
    enableQuestionPasswordReset: false,
    enableSmartAccess: false,
    enableSmsPasswordReset: false,
    enableSystemUseNotification: false,
    enableUnlockViaPasswordReset: false,
    enforceAccountPasswordBlacklist: false,
    enforceCompromisedCredentialsCheck: false,
    eubaEnabled: false,
    eubaRiskThreshold: 0,
    facebook: false,
    forceAuthn: false,
    gdtRequired: false,
    google: false,
    ignoreXff: false,
    inviteExpirationTimeUnit: 0,
    inviteExpirationTimeValue: 0,
    ipAddrRestriction: "string",
    linkedin: false,
    lockEffectiveMinutes: 0,
    maximumInvalidLoginAttempts: 0,
    mfaRegistrationEnabled: false,
    minimumPasswordLength: 0,
    name: "string",
    newPortalSetting: "string",
    otpAuthEnabled: false,
    otpConfig: 0,
    otpSecurityTokenExpirationDays: 0,
    otpTriggerCondition: 0,
    passwordComplexityRequirements: 0,
    passwordExpirationDays: 0,
    passwordRedirectEnabled: false,
    passwordRedirectMessage: "string",
    passwordRedirectUrl: "string",
    passwordsRemembered: 0,
    persistentSessionEnabled: false,
    policiesId: "string",
    preferredAuthStateMachine: 0,
    profilePolicyId: 0,
    requireSecurityQuestions: false,
    resetPasswordAuthenticationFactorIds: [0],
    secureAdmin: false,
    secureAreaOtpTimeoutMinutes: 0,
    secureProfile: false,
    selfInstallCert: false,
    sessionTimeoutByFixedTimeUnit: 0,
    sessionTimeoutByFixedTimeValue: 0,
    sessionTimeoutByInactivityUnit: 0,
    sessionTimeoutByInactivityValue: 0,
    sessionTimeoutMinutes: 0,
    sessionTimeoutType: 0,
    smartAccessRiskThreshold: 0,
    socialSignIn: false,
    systemUseNotification: "string",
    termsAndConditions: {
        content: "string",
        enabled: false,
    },
    thirdPartyDeviceTrust: false,
    trackInactiveUsers: false,
    trustedDeviceLoginEnabled: false,
    trustedDeviceLoginMfaAllowed: false,
    twitter: false,
    userPhoneUpdateAllowed: false,
    voluntaryMfaRegistrationEnabled: false,
});

    type: onelogin:Policies
properties:
    adminPolicyId: 0
    allowAddCompanyApp: false
    allowAddPersonalApp: false
    appForceAuthnOffset: 0
    appOtpOffset: 0
    appOtpOffsetEnabled: false
    authenticationFactorIds:
        - 0
    browserCertRequired: false
    browserPkiExpiration: 0
    disableBrowserPasswordManager: false
    disableProtectPushNotifications: false
    disableProtectPushRecovery: false
    dynamicBlacklistAttributes: string
    enableBrowserExtensions: false
    enableEmailHint: false
    enableEmailPasswordReset: false
    enableNumberMatch: false
    enablePasswordChange: false
    enableQuestionPasswordReset: false
    enableSmartAccess: false
    enableSmsPasswordReset: false
    enableSystemUseNotification: false
    enableUnlockViaPasswordReset: false
    enforceAccountPasswordBlacklist: false
    enforceCompromisedCredentialsCheck: false
    eubaEnabled: false
    eubaRiskThreshold: 0
    facebook: false
    forceAuthn: false
    gdtRequired: false
    google: false
    ignoreXff: false
    inviteExpirationTimeUnit: 0
    inviteExpirationTimeValue: 0
    ipAddrRestriction: string
    kind: string
    linkedin: false
    lockEffectiveMinutes: 0
    maximumInvalidLoginAttempts: 0
    mfaRegistrationEnabled: false
    minimumPasswordLength: 0
    name: string
    newPortalSetting: string
    otpAuthEnabled: false
    otpConfig: 0
    otpSecurityTokenExpirationDays: 0
    otpTriggerCondition: 0
    passwordComplexityRequirements: 0
    passwordExpirationDays: 0
    passwordRedirectEnabled: false
    passwordRedirectMessage: string
    passwordRedirectUrl: string
    passwordsRemembered: 0
    persistentSessionEnabled: false
    policiesId: string
    preferredAuthStateMachine: 0
    profilePolicyId: 0
    requireSecurityQuestions: false
    resetPasswordAuthenticationFactorIds:
        - 0
    secureAdmin: false
    secureAreaOtpTimeoutMinutes: 0
    secureProfile: false
    selfInstallCert: false
    sessionTimeoutByFixedTimeUnit: 0
    sessionTimeoutByFixedTimeValue: 0
    sessionTimeoutByInactivityUnit: 0
    sessionTimeoutByInactivityValue: 0
    sessionTimeoutMinutes: 0
    sessionTimeoutType: 0
    smartAccessRiskThreshold: 0
    socialSignIn: false
    systemUseNotification: string
    termsAndConditions:
        content: string
        enabled: false
    thirdPartyDeviceTrust: false
    trackInactiveUsers: false
    trustedDeviceLoginEnabled: false
    trustedDeviceLoginMfaAllowed: false
    twitter: false
    userPhoneUpdateAllowed: false
    voluntaryMfaRegistrationEnabled: false

    Policies Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Policies resource accepts the following input properties:

    Kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    AdminPolicyId double
    App policy that governs step-up authentication for the admin area.
    AllowAddCompanyApp bool
    Let users add company apps to their portal.
    AllowAddPersonalApp bool
    Let users add personal apps to their portal.
    AppForceAuthnOffset double
    Minutes before force_authn applies again.
    AppOtpOffset double
    Minutes an app MFA prompt is remembered.
    AppOtpOffsetEnabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    AuthenticationFactorIds List<double>
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    BrowserCertRequired bool
    Require a browser certificate.
    BrowserPkiExpiration double
    Days a browser certificate stays valid.
    DisableBrowserPasswordManager bool
    Stop the browser offering to save passwords.
    DisableProtectPushNotifications bool
    Turn off OneLogin Protect push notifications.
    DisableProtectPushRecovery bool
    Turn off OneLogin Protect push recovery.
    DynamicBlacklistAttributes string
    User attributes whose values may not appear in a password.
    EnableBrowserExtensions bool
    Allow the OneLogin browser extension.
    EnableEmailHint bool
    Prefill the email field on the login page.
    EnableEmailPasswordReset bool
    Offer password reset by email.
    EnableNumberMatch bool
    Require number matching on push notifications.
    EnablePasswordChange bool
    Let users change their own password.
    EnableQuestionPasswordReset bool
    Offer password reset by security question.
    EnableSmartAccess bool
    Enable SmartAccess risk scoring.
    EnableSmsPasswordReset bool
    Offer password reset by SMS.
    EnableSystemUseNotification bool
    Show a system use notification before login.
    EnableUnlockViaPasswordReset bool
    Unlock a locked account when the user resets their password.
    EnforceAccountPasswordBlacklist bool
    Reject passwords on the account's blacklist.
    EnforceCompromisedCredentialsCheck bool
    Check credentials against known breaches.
    EubaEnabled bool
    Enable end-user behaviour analytics.
    EubaRiskThreshold double
    Risk score above which EUBA acts.
    Facebook bool
    Allow sign-in with Facebook.
    ForceAuthn bool
    Force re-authentication when the app is opened.
    GdtRequired bool
    Require OneLogin Desktop for this app.
    Google bool
    Allow sign-in with Google.
    IgnoreXff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    InviteExpirationTimeUnit double
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    InviteExpirationTimeValue double
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    IpAddrRestriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    Linkedin bool
    Allow sign-in with LinkedIn.
    LockEffectiveMinutes double
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    MaximumInvalidLoginAttempts double
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    MfaRegistrationEnabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    MinimumPasswordLength double
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    Name string
    Name of the policy.
    NewPortalSetting string
    Access to the new portal: required, allowed or forbidden.
    OtpAuthEnabled bool
    Require multi-factor authentication.
    OtpConfig double
    Which factors MFA accepts.
    OtpSecurityTokenExpirationDays double
    Days a remembered MFA device stays trusted. 1 to 99999.
    OtpTriggerCondition double
    When MFA is triggered.
    PasswordComplexityRequirements double
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    PasswordExpirationDays double
    Days before a password expires. 0 never expires.
    PasswordRedirectEnabled bool
    Send password changes to an external URL instead.
    PasswordRedirectMessage string
    Message shown alongside the password redirect.
    PasswordRedirectUrl string
    URL to send password changes to. Required when password_redirect_enabled is true.
    PasswordsRemembered double
    How many previous passwords cannot be reused. 0, 3 or 5.
    PersistentSessionEnabled bool
    Let sessions survive a browser restart.
    PoliciesId string
    The policy ID.
    PreferredAuthStateMachine double
    Login flow the policy prefers.
    ProfilePolicyId double
    App policy that governs step-up authentication for the profile area.
    RequireSecurityQuestions bool
    Require users to set security questions.
    ResetPasswordAuthenticationFactorIds List<double>
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    SecureAdmin bool
    Require step-up authentication to reach the admin area.
    SecureAreaOtpTimeoutMinutes double
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    SecureProfile bool
    Require step-up authentication to reach the user profile area.
    SelfInstallCert bool
    Let users install their own browser certificate.
    SessionTimeoutByFixedTimeUnit double
    Unit for session_timeout_by_fixed_time_value.
    SessionTimeoutByFixedTimeValue double
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    SessionTimeoutByInactivityUnit double
    Unit for session_timeout_by_inactivity_value.
    SessionTimeoutByInactivityValue double
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    SessionTimeoutMinutes double
    Session length in minutes, in the older single-value format.
    SessionTimeoutType double
    Which session timeout applies: by inactivity or at a fixed time.
    SmartAccessRiskThreshold double
    Risk score above which SmartAccess acts.
    SocialSignIn bool
    Allow social sign-in.
    SystemUseNotification string
    Text of the system use notification.
    TermsAndConditions PoliciesTermsAndConditions
    Terms users must accept before signing in. Applies to user policies only.
    ThirdPartyDeviceTrust bool
    Require a third-party device trust check.
    TrackInactiveUsers bool
    Track users who have not logged in recently.
    TrustedDeviceLoginEnabled bool
    Allow login from trusted devices.
    TrustedDeviceLoginMfaAllowed bool
    Allow MFA on trusted device login.
    Twitter bool
    Allow sign-in with Twitter.
    UserPhoneUpdateAllowed bool
    Let users change their registered phone number.
    VoluntaryMfaRegistrationEnabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    Kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    AdminPolicyId float64
    App policy that governs step-up authentication for the admin area.
    AllowAddCompanyApp bool
    Let users add company apps to their portal.
    AllowAddPersonalApp bool
    Let users add personal apps to their portal.
    AppForceAuthnOffset float64
    Minutes before force_authn applies again.
    AppOtpOffset float64
    Minutes an app MFA prompt is remembered.
    AppOtpOffsetEnabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    AuthenticationFactorIds []float64
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    BrowserCertRequired bool
    Require a browser certificate.
    BrowserPkiExpiration float64
    Days a browser certificate stays valid.
    DisableBrowserPasswordManager bool
    Stop the browser offering to save passwords.
    DisableProtectPushNotifications bool
    Turn off OneLogin Protect push notifications.
    DisableProtectPushRecovery bool
    Turn off OneLogin Protect push recovery.
    DynamicBlacklistAttributes string
    User attributes whose values may not appear in a password.
    EnableBrowserExtensions bool
    Allow the OneLogin browser extension.
    EnableEmailHint bool
    Prefill the email field on the login page.
    EnableEmailPasswordReset bool
    Offer password reset by email.
    EnableNumberMatch bool
    Require number matching on push notifications.
    EnablePasswordChange bool
    Let users change their own password.
    EnableQuestionPasswordReset bool
    Offer password reset by security question.
    EnableSmartAccess bool
    Enable SmartAccess risk scoring.
    EnableSmsPasswordReset bool
    Offer password reset by SMS.
    EnableSystemUseNotification bool
    Show a system use notification before login.
    EnableUnlockViaPasswordReset bool
    Unlock a locked account when the user resets their password.
    EnforceAccountPasswordBlacklist bool
    Reject passwords on the account's blacklist.
    EnforceCompromisedCredentialsCheck bool
    Check credentials against known breaches.
    EubaEnabled bool
    Enable end-user behaviour analytics.
    EubaRiskThreshold float64
    Risk score above which EUBA acts.
    Facebook bool
    Allow sign-in with Facebook.
    ForceAuthn bool
    Force re-authentication when the app is opened.
    GdtRequired bool
    Require OneLogin Desktop for this app.
    Google bool
    Allow sign-in with Google.
    IgnoreXff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    InviteExpirationTimeUnit float64
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    InviteExpirationTimeValue float64
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    IpAddrRestriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    Linkedin bool
    Allow sign-in with LinkedIn.
    LockEffectiveMinutes float64
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    MaximumInvalidLoginAttempts float64
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    MfaRegistrationEnabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    MinimumPasswordLength float64
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    Name string
    Name of the policy.
    NewPortalSetting string
    Access to the new portal: required, allowed or forbidden.
    OtpAuthEnabled bool
    Require multi-factor authentication.
    OtpConfig float64
    Which factors MFA accepts.
    OtpSecurityTokenExpirationDays float64
    Days a remembered MFA device stays trusted. 1 to 99999.
    OtpTriggerCondition float64
    When MFA is triggered.
    PasswordComplexityRequirements float64
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    PasswordExpirationDays float64
    Days before a password expires. 0 never expires.
    PasswordRedirectEnabled bool
    Send password changes to an external URL instead.
    PasswordRedirectMessage string
    Message shown alongside the password redirect.
    PasswordRedirectUrl string
    URL to send password changes to. Required when password_redirect_enabled is true.
    PasswordsRemembered float64
    How many previous passwords cannot be reused. 0, 3 or 5.
    PersistentSessionEnabled bool
    Let sessions survive a browser restart.
    PoliciesId string
    The policy ID.
    PreferredAuthStateMachine float64
    Login flow the policy prefers.
    ProfilePolicyId float64
    App policy that governs step-up authentication for the profile area.
    RequireSecurityQuestions bool
    Require users to set security questions.
    ResetPasswordAuthenticationFactorIds []float64
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    SecureAdmin bool
    Require step-up authentication to reach the admin area.
    SecureAreaOtpTimeoutMinutes float64
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    SecureProfile bool
    Require step-up authentication to reach the user profile area.
    SelfInstallCert bool
    Let users install their own browser certificate.
    SessionTimeoutByFixedTimeUnit float64
    Unit for session_timeout_by_fixed_time_value.
    SessionTimeoutByFixedTimeValue float64
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    SessionTimeoutByInactivityUnit float64
    Unit for session_timeout_by_inactivity_value.
    SessionTimeoutByInactivityValue float64
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    SessionTimeoutMinutes float64
    Session length in minutes, in the older single-value format.
    SessionTimeoutType float64
    Which session timeout applies: by inactivity or at a fixed time.
    SmartAccessRiskThreshold float64
    Risk score above which SmartAccess acts.
    SocialSignIn bool
    Allow social sign-in.
    SystemUseNotification string
    Text of the system use notification.
    TermsAndConditions PoliciesTermsAndConditionsArgs
    Terms users must accept before signing in. Applies to user policies only.
    ThirdPartyDeviceTrust bool
    Require a third-party device trust check.
    TrackInactiveUsers bool
    Track users who have not logged in recently.
    TrustedDeviceLoginEnabled bool
    Allow login from trusted devices.
    TrustedDeviceLoginMfaAllowed bool
    Allow MFA on trusted device login.
    Twitter bool
    Allow sign-in with Twitter.
    UserPhoneUpdateAllowed bool
    Let users change their registered phone number.
    VoluntaryMfaRegistrationEnabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    admin_policy_id number
    App policy that governs step-up authentication for the admin area.
    allow_add_company_app bool
    Let users add company apps to their portal.
    allow_add_personal_app bool
    Let users add personal apps to their portal.
    app_force_authn_offset number
    Minutes before force_authn applies again.
    app_otp_offset number
    Minutes an app MFA prompt is remembered.
    app_otp_offset_enabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    authentication_factor_ids list(number)
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browser_cert_required bool
    Require a browser certificate.
    browser_pki_expiration number
    Days a browser certificate stays valid.
    disable_browser_password_manager bool
    Stop the browser offering to save passwords.
    disable_protect_push_notifications bool
    Turn off OneLogin Protect push notifications.
    disable_protect_push_recovery bool
    Turn off OneLogin Protect push recovery.
    dynamic_blacklist_attributes string
    User attributes whose values may not appear in a password.
    enable_browser_extensions bool
    Allow the OneLogin browser extension.
    enable_email_hint bool
    Prefill the email field on the login page.
    enable_email_password_reset bool
    Offer password reset by email.
    enable_number_match bool
    Require number matching on push notifications.
    enable_password_change bool
    Let users change their own password.
    enable_question_password_reset bool
    Offer password reset by security question.
    enable_smart_access bool
    Enable SmartAccess risk scoring.
    enable_sms_password_reset bool
    Offer password reset by SMS.
    enable_system_use_notification bool
    Show a system use notification before login.
    enable_unlock_via_password_reset bool
    Unlock a locked account when the user resets their password.
    enforce_account_password_blacklist bool
    Reject passwords on the account's blacklist.
    enforce_compromised_credentials_check bool
    Check credentials against known breaches.
    euba_enabled bool
    Enable end-user behaviour analytics.
    euba_risk_threshold number
    Risk score above which EUBA acts.
    facebook bool
    Allow sign-in with Facebook.
    force_authn bool
    Force re-authentication when the app is opened.
    gdt_required bool
    Require OneLogin Desktop for this app.
    google bool
    Allow sign-in with Google.
    ignore_xff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    invite_expiration_time_unit number
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    invite_expiration_time_value number
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ip_addr_restriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    linkedin bool
    Allow sign-in with LinkedIn.
    lock_effective_minutes number
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximum_invalid_login_attempts number
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfa_registration_enabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimum_password_length number
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name string
    Name of the policy.
    new_portal_setting string
    Access to the new portal: required, allowed or forbidden.
    otp_auth_enabled bool
    Require multi-factor authentication.
    otp_config number
    Which factors MFA accepts.
    otp_security_token_expiration_days number
    Days a remembered MFA device stays trusted. 1 to 99999.
    otp_trigger_condition number
    When MFA is triggered.
    password_complexity_requirements number
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    password_expiration_days number
    Days before a password expires. 0 never expires.
    password_redirect_enabled bool
    Send password changes to an external URL instead.
    password_redirect_message string
    Message shown alongside the password redirect.
    password_redirect_url string
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwords_remembered number
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistent_session_enabled bool
    Let sessions survive a browser restart.
    policies_id string
    The policy ID.
    preferred_auth_state_machine number
    Login flow the policy prefers.
    profile_policy_id number
    App policy that governs step-up authentication for the profile area.
    require_security_questions bool
    Require users to set security questions.
    reset_password_authentication_factor_ids list(number)
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secure_admin bool
    Require step-up authentication to reach the admin area.
    secure_area_otp_timeout_minutes number
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secure_profile bool
    Require step-up authentication to reach the user profile area.
    self_install_cert bool
    Let users install their own browser certificate.
    session_timeout_by_fixed_time_unit number
    Unit for session_timeout_by_fixed_time_value.
    session_timeout_by_fixed_time_value number
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    session_timeout_by_inactivity_unit number
    Unit for session_timeout_by_inactivity_value.
    session_timeout_by_inactivity_value number
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    session_timeout_minutes number
    Session length in minutes, in the older single-value format.
    session_timeout_type number
    Which session timeout applies: by inactivity or at a fixed time.
    smart_access_risk_threshold number
    Risk score above which SmartAccess acts.
    social_sign_in bool
    Allow social sign-in.
    system_use_notification string
    Text of the system use notification.
    terms_and_conditions object
    Terms users must accept before signing in. Applies to user policies only.
    third_party_device_trust bool
    Require a third-party device trust check.
    track_inactive_users bool
    Track users who have not logged in recently.
    trusted_device_login_enabled bool
    Allow login from trusted devices.
    trusted_device_login_mfa_allowed bool
    Allow MFA on trusted device login.
    twitter bool
    Allow sign-in with Twitter.
    user_phone_update_allowed bool
    Let users change their registered phone number.
    voluntary_mfa_registration_enabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    kind String
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    adminPolicyId Double
    App policy that governs step-up authentication for the admin area.
    allowAddCompanyApp Boolean
    Let users add company apps to their portal.
    allowAddPersonalApp Boolean
    Let users add personal apps to their portal.
    appForceAuthnOffset Double
    Minutes before force_authn applies again.
    appOtpOffset Double
    Minutes an app MFA prompt is remembered.
    appOtpOffsetEnabled Boolean
    Remember an app MFA prompt for app_otp_offset minutes.
    authenticationFactorIds List<Double>
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browserCertRequired Boolean
    Require a browser certificate.
    browserPkiExpiration Double
    Days a browser certificate stays valid.
    disableBrowserPasswordManager Boolean
    Stop the browser offering to save passwords.
    disableProtectPushNotifications Boolean
    Turn off OneLogin Protect push notifications.
    disableProtectPushRecovery Boolean
    Turn off OneLogin Protect push recovery.
    dynamicBlacklistAttributes String
    User attributes whose values may not appear in a password.
    enableBrowserExtensions Boolean
    Allow the OneLogin browser extension.
    enableEmailHint Boolean
    Prefill the email field on the login page.
    enableEmailPasswordReset Boolean
    Offer password reset by email.
    enableNumberMatch Boolean
    Require number matching on push notifications.
    enablePasswordChange Boolean
    Let users change their own password.
    enableQuestionPasswordReset Boolean
    Offer password reset by security question.
    enableSmartAccess Boolean
    Enable SmartAccess risk scoring.
    enableSmsPasswordReset Boolean
    Offer password reset by SMS.
    enableSystemUseNotification Boolean
    Show a system use notification before login.
    enableUnlockViaPasswordReset Boolean
    Unlock a locked account when the user resets their password.
    enforceAccountPasswordBlacklist Boolean
    Reject passwords on the account's blacklist.
    enforceCompromisedCredentialsCheck Boolean
    Check credentials against known breaches.
    eubaEnabled Boolean
    Enable end-user behaviour analytics.
    eubaRiskThreshold Double
    Risk score above which EUBA acts.
    facebook Boolean
    Allow sign-in with Facebook.
    forceAuthn Boolean
    Force re-authentication when the app is opened.
    gdtRequired Boolean
    Require OneLogin Desktop for this app.
    google Boolean
    Allow sign-in with Google.
    ignoreXff Boolean
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    inviteExpirationTimeUnit Double
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    inviteExpirationTimeValue Double
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ipAddrRestriction String
    Newline-separated list of allowed IP addresses or CIDR ranges.
    linkedin Boolean
    Allow sign-in with LinkedIn.
    lockEffectiveMinutes Double
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximumInvalidLoginAttempts Double
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfaRegistrationEnabled Boolean
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimumPasswordLength Double
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name String
    Name of the policy.
    newPortalSetting String
    Access to the new portal: required, allowed or forbidden.
    otpAuthEnabled Boolean
    Require multi-factor authentication.
    otpConfig Double
    Which factors MFA accepts.
    otpSecurityTokenExpirationDays Double
    Days a remembered MFA device stays trusted. 1 to 99999.
    otpTriggerCondition Double
    When MFA is triggered.
    passwordComplexityRequirements Double
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    passwordExpirationDays Double
    Days before a password expires. 0 never expires.
    passwordRedirectEnabled Boolean
    Send password changes to an external URL instead.
    passwordRedirectMessage String
    Message shown alongside the password redirect.
    passwordRedirectUrl String
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwordsRemembered Double
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistentSessionEnabled Boolean
    Let sessions survive a browser restart.
    policiesId String
    The policy ID.
    preferredAuthStateMachine Double
    Login flow the policy prefers.
    profilePolicyId Double
    App policy that governs step-up authentication for the profile area.
    requireSecurityQuestions Boolean
    Require users to set security questions.
    resetPasswordAuthenticationFactorIds List<Double>
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secureAdmin Boolean
    Require step-up authentication to reach the admin area.
    secureAreaOtpTimeoutMinutes Double
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secureProfile Boolean
    Require step-up authentication to reach the user profile area.
    selfInstallCert Boolean
    Let users install their own browser certificate.
    sessionTimeoutByFixedTimeUnit Double
    Unit for session_timeout_by_fixed_time_value.
    sessionTimeoutByFixedTimeValue Double
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    sessionTimeoutByInactivityUnit Double
    Unit for session_timeout_by_inactivity_value.
    sessionTimeoutByInactivityValue Double
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    sessionTimeoutMinutes Double
    Session length in minutes, in the older single-value format.
    sessionTimeoutType Double
    Which session timeout applies: by inactivity or at a fixed time.
    smartAccessRiskThreshold Double
    Risk score above which SmartAccess acts.
    socialSignIn Boolean
    Allow social sign-in.
    systemUseNotification String
    Text of the system use notification.
    termsAndConditions PoliciesTermsAndConditions
    Terms users must accept before signing in. Applies to user policies only.
    thirdPartyDeviceTrust Boolean
    Require a third-party device trust check.
    trackInactiveUsers Boolean
    Track users who have not logged in recently.
    trustedDeviceLoginEnabled Boolean
    Allow login from trusted devices.
    trustedDeviceLoginMfaAllowed Boolean
    Allow MFA on trusted device login.
    twitter Boolean
    Allow sign-in with Twitter.
    userPhoneUpdateAllowed Boolean
    Let users change their registered phone number.
    voluntaryMfaRegistrationEnabled Boolean
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    adminPolicyId number
    App policy that governs step-up authentication for the admin area.
    allowAddCompanyApp boolean
    Let users add company apps to their portal.
    allowAddPersonalApp boolean
    Let users add personal apps to their portal.
    appForceAuthnOffset number
    Minutes before force_authn applies again.
    appOtpOffset number
    Minutes an app MFA prompt is remembered.
    appOtpOffsetEnabled boolean
    Remember an app MFA prompt for app_otp_offset minutes.
    authenticationFactorIds number[]
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browserCertRequired boolean
    Require a browser certificate.
    browserPkiExpiration number
    Days a browser certificate stays valid.
    disableBrowserPasswordManager boolean
    Stop the browser offering to save passwords.
    disableProtectPushNotifications boolean
    Turn off OneLogin Protect push notifications.
    disableProtectPushRecovery boolean
    Turn off OneLogin Protect push recovery.
    dynamicBlacklistAttributes string
    User attributes whose values may not appear in a password.
    enableBrowserExtensions boolean
    Allow the OneLogin browser extension.
    enableEmailHint boolean
    Prefill the email field on the login page.
    enableEmailPasswordReset boolean
    Offer password reset by email.
    enableNumberMatch boolean
    Require number matching on push notifications.
    enablePasswordChange boolean
    Let users change their own password.
    enableQuestionPasswordReset boolean
    Offer password reset by security question.
    enableSmartAccess boolean
    Enable SmartAccess risk scoring.
    enableSmsPasswordReset boolean
    Offer password reset by SMS.
    enableSystemUseNotification boolean
    Show a system use notification before login.
    enableUnlockViaPasswordReset boolean
    Unlock a locked account when the user resets their password.
    enforceAccountPasswordBlacklist boolean
    Reject passwords on the account's blacklist.
    enforceCompromisedCredentialsCheck boolean
    Check credentials against known breaches.
    eubaEnabled boolean
    Enable end-user behaviour analytics.
    eubaRiskThreshold number
    Risk score above which EUBA acts.
    facebook boolean
    Allow sign-in with Facebook.
    forceAuthn boolean
    Force re-authentication when the app is opened.
    gdtRequired boolean
    Require OneLogin Desktop for this app.
    google boolean
    Allow sign-in with Google.
    ignoreXff boolean
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    inviteExpirationTimeUnit number
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    inviteExpirationTimeValue number
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ipAddrRestriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    linkedin boolean
    Allow sign-in with LinkedIn.
    lockEffectiveMinutes number
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximumInvalidLoginAttempts number
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfaRegistrationEnabled boolean
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimumPasswordLength number
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name string
    Name of the policy.
    newPortalSetting string
    Access to the new portal: required, allowed or forbidden.
    otpAuthEnabled boolean
    Require multi-factor authentication.
    otpConfig number
    Which factors MFA accepts.
    otpSecurityTokenExpirationDays number
    Days a remembered MFA device stays trusted. 1 to 99999.
    otpTriggerCondition number
    When MFA is triggered.
    passwordComplexityRequirements number
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    passwordExpirationDays number
    Days before a password expires. 0 never expires.
    passwordRedirectEnabled boolean
    Send password changes to an external URL instead.
    passwordRedirectMessage string
    Message shown alongside the password redirect.
    passwordRedirectUrl string
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwordsRemembered number
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistentSessionEnabled boolean
    Let sessions survive a browser restart.
    policiesId string
    The policy ID.
    preferredAuthStateMachine number
    Login flow the policy prefers.
    profilePolicyId number
    App policy that governs step-up authentication for the profile area.
    requireSecurityQuestions boolean
    Require users to set security questions.
    resetPasswordAuthenticationFactorIds number[]
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secureAdmin boolean
    Require step-up authentication to reach the admin area.
    secureAreaOtpTimeoutMinutes number
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secureProfile boolean
    Require step-up authentication to reach the user profile area.
    selfInstallCert boolean
    Let users install their own browser certificate.
    sessionTimeoutByFixedTimeUnit number
    Unit for session_timeout_by_fixed_time_value.
    sessionTimeoutByFixedTimeValue number
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    sessionTimeoutByInactivityUnit number
    Unit for session_timeout_by_inactivity_value.
    sessionTimeoutByInactivityValue number
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    sessionTimeoutMinutes number
    Session length in minutes, in the older single-value format.
    sessionTimeoutType number
    Which session timeout applies: by inactivity or at a fixed time.
    smartAccessRiskThreshold number
    Risk score above which SmartAccess acts.
    socialSignIn boolean
    Allow social sign-in.
    systemUseNotification string
    Text of the system use notification.
    termsAndConditions PoliciesTermsAndConditions
    Terms users must accept before signing in. Applies to user policies only.
    thirdPartyDeviceTrust boolean
    Require a third-party device trust check.
    trackInactiveUsers boolean
    Track users who have not logged in recently.
    trustedDeviceLoginEnabled boolean
    Allow login from trusted devices.
    trustedDeviceLoginMfaAllowed boolean
    Allow MFA on trusted device login.
    twitter boolean
    Allow sign-in with Twitter.
    userPhoneUpdateAllowed boolean
    Let users change their registered phone number.
    voluntaryMfaRegistrationEnabled boolean
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    kind str
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    admin_policy_id float
    App policy that governs step-up authentication for the admin area.
    allow_add_company_app bool
    Let users add company apps to their portal.
    allow_add_personal_app bool
    Let users add personal apps to their portal.
    app_force_authn_offset float
    Minutes before force_authn applies again.
    app_otp_offset float
    Minutes an app MFA prompt is remembered.
    app_otp_offset_enabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    authentication_factor_ids Sequence[float]
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browser_cert_required bool
    Require a browser certificate.
    browser_pki_expiration float
    Days a browser certificate stays valid.
    disable_browser_password_manager bool
    Stop the browser offering to save passwords.
    disable_protect_push_notifications bool
    Turn off OneLogin Protect push notifications.
    disable_protect_push_recovery bool
    Turn off OneLogin Protect push recovery.
    dynamic_blacklist_attributes str
    User attributes whose values may not appear in a password.
    enable_browser_extensions bool
    Allow the OneLogin browser extension.
    enable_email_hint bool
    Prefill the email field on the login page.
    enable_email_password_reset bool
    Offer password reset by email.
    enable_number_match bool
    Require number matching on push notifications.
    enable_password_change bool
    Let users change their own password.
    enable_question_password_reset bool
    Offer password reset by security question.
    enable_smart_access bool
    Enable SmartAccess risk scoring.
    enable_sms_password_reset bool
    Offer password reset by SMS.
    enable_system_use_notification bool
    Show a system use notification before login.
    enable_unlock_via_password_reset bool
    Unlock a locked account when the user resets their password.
    enforce_account_password_blacklist bool
    Reject passwords on the account's blacklist.
    enforce_compromised_credentials_check bool
    Check credentials against known breaches.
    euba_enabled bool
    Enable end-user behaviour analytics.
    euba_risk_threshold float
    Risk score above which EUBA acts.
    facebook bool
    Allow sign-in with Facebook.
    force_authn bool
    Force re-authentication when the app is opened.
    gdt_required bool
    Require OneLogin Desktop for this app.
    google bool
    Allow sign-in with Google.
    ignore_xff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    invite_expiration_time_unit float
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    invite_expiration_time_value float
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ip_addr_restriction str
    Newline-separated list of allowed IP addresses or CIDR ranges.
    linkedin bool
    Allow sign-in with LinkedIn.
    lock_effective_minutes float
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximum_invalid_login_attempts float
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfa_registration_enabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimum_password_length float
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name str
    Name of the policy.
    new_portal_setting str
    Access to the new portal: required, allowed or forbidden.
    otp_auth_enabled bool
    Require multi-factor authentication.
    otp_config float
    Which factors MFA accepts.
    otp_security_token_expiration_days float
    Days a remembered MFA device stays trusted. 1 to 99999.
    otp_trigger_condition float
    When MFA is triggered.
    password_complexity_requirements float
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    password_expiration_days float
    Days before a password expires. 0 never expires.
    password_redirect_enabled bool
    Send password changes to an external URL instead.
    password_redirect_message str
    Message shown alongside the password redirect.
    password_redirect_url str
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwords_remembered float
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistent_session_enabled bool
    Let sessions survive a browser restart.
    policies_id str
    The policy ID.
    preferred_auth_state_machine float
    Login flow the policy prefers.
    profile_policy_id float
    App policy that governs step-up authentication for the profile area.
    require_security_questions bool
    Require users to set security questions.
    reset_password_authentication_factor_ids Sequence[float]
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secure_admin bool
    Require step-up authentication to reach the admin area.
    secure_area_otp_timeout_minutes float
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secure_profile bool
    Require step-up authentication to reach the user profile area.
    self_install_cert bool
    Let users install their own browser certificate.
    session_timeout_by_fixed_time_unit float
    Unit for session_timeout_by_fixed_time_value.
    session_timeout_by_fixed_time_value float
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    session_timeout_by_inactivity_unit float
    Unit for session_timeout_by_inactivity_value.
    session_timeout_by_inactivity_value float
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    session_timeout_minutes float
    Session length in minutes, in the older single-value format.
    session_timeout_type float
    Which session timeout applies: by inactivity or at a fixed time.
    smart_access_risk_threshold float
    Risk score above which SmartAccess acts.
    social_sign_in bool
    Allow social sign-in.
    system_use_notification str
    Text of the system use notification.
    terms_and_conditions PoliciesTermsAndConditionsArgs
    Terms users must accept before signing in. Applies to user policies only.
    third_party_device_trust bool
    Require a third-party device trust check.
    track_inactive_users bool
    Track users who have not logged in recently.
    trusted_device_login_enabled bool
    Allow login from trusted devices.
    trusted_device_login_mfa_allowed bool
    Allow MFA on trusted device login.
    twitter bool
    Allow sign-in with Twitter.
    user_phone_update_allowed bool
    Let users change their registered phone number.
    voluntary_mfa_registration_enabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    kind String
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    adminPolicyId Number
    App policy that governs step-up authentication for the admin area.
    allowAddCompanyApp Boolean
    Let users add company apps to their portal.
    allowAddPersonalApp Boolean
    Let users add personal apps to their portal.
    appForceAuthnOffset Number
    Minutes before force_authn applies again.
    appOtpOffset Number
    Minutes an app MFA prompt is remembered.
    appOtpOffsetEnabled Boolean
    Remember an app MFA prompt for app_otp_offset minutes.
    authenticationFactorIds List<Number>
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browserCertRequired Boolean
    Require a browser certificate.
    browserPkiExpiration Number
    Days a browser certificate stays valid.
    disableBrowserPasswordManager Boolean
    Stop the browser offering to save passwords.
    disableProtectPushNotifications Boolean
    Turn off OneLogin Protect push notifications.
    disableProtectPushRecovery Boolean
    Turn off OneLogin Protect push recovery.
    dynamicBlacklistAttributes String
    User attributes whose values may not appear in a password.
    enableBrowserExtensions Boolean
    Allow the OneLogin browser extension.
    enableEmailHint Boolean
    Prefill the email field on the login page.
    enableEmailPasswordReset Boolean
    Offer password reset by email.
    enableNumberMatch Boolean
    Require number matching on push notifications.
    enablePasswordChange Boolean
    Let users change their own password.
    enableQuestionPasswordReset Boolean
    Offer password reset by security question.
    enableSmartAccess Boolean
    Enable SmartAccess risk scoring.
    enableSmsPasswordReset Boolean
    Offer password reset by SMS.
    enableSystemUseNotification Boolean
    Show a system use notification before login.
    enableUnlockViaPasswordReset Boolean
    Unlock a locked account when the user resets their password.
    enforceAccountPasswordBlacklist Boolean
    Reject passwords on the account's blacklist.
    enforceCompromisedCredentialsCheck Boolean
    Check credentials against known breaches.
    eubaEnabled Boolean
    Enable end-user behaviour analytics.
    eubaRiskThreshold Number
    Risk score above which EUBA acts.
    facebook Boolean
    Allow sign-in with Facebook.
    forceAuthn Boolean
    Force re-authentication when the app is opened.
    gdtRequired Boolean
    Require OneLogin Desktop for this app.
    google Boolean
    Allow sign-in with Google.
    ignoreXff Boolean
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    inviteExpirationTimeUnit Number
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    inviteExpirationTimeValue Number
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ipAddrRestriction String
    Newline-separated list of allowed IP addresses or CIDR ranges.
    linkedin Boolean
    Allow sign-in with LinkedIn.
    lockEffectiveMinutes Number
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximumInvalidLoginAttempts Number
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfaRegistrationEnabled Boolean
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimumPasswordLength Number
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name String
    Name of the policy.
    newPortalSetting String
    Access to the new portal: required, allowed or forbidden.
    otpAuthEnabled Boolean
    Require multi-factor authentication.
    otpConfig Number
    Which factors MFA accepts.
    otpSecurityTokenExpirationDays Number
    Days a remembered MFA device stays trusted. 1 to 99999.
    otpTriggerCondition Number
    When MFA is triggered.
    passwordComplexityRequirements Number
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    passwordExpirationDays Number
    Days before a password expires. 0 never expires.
    passwordRedirectEnabled Boolean
    Send password changes to an external URL instead.
    passwordRedirectMessage String
    Message shown alongside the password redirect.
    passwordRedirectUrl String
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwordsRemembered Number
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistentSessionEnabled Boolean
    Let sessions survive a browser restart.
    policiesId String
    The policy ID.
    preferredAuthStateMachine Number
    Login flow the policy prefers.
    profilePolicyId Number
    App policy that governs step-up authentication for the profile area.
    requireSecurityQuestions Boolean
    Require users to set security questions.
    resetPasswordAuthenticationFactorIds List<Number>
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secureAdmin Boolean
    Require step-up authentication to reach the admin area.
    secureAreaOtpTimeoutMinutes Number
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secureProfile Boolean
    Require step-up authentication to reach the user profile area.
    selfInstallCert Boolean
    Let users install their own browser certificate.
    sessionTimeoutByFixedTimeUnit Number
    Unit for session_timeout_by_fixed_time_value.
    sessionTimeoutByFixedTimeValue Number
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    sessionTimeoutByInactivityUnit Number
    Unit for session_timeout_by_inactivity_value.
    sessionTimeoutByInactivityValue Number
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    sessionTimeoutMinutes Number
    Session length in minutes, in the older single-value format.
    sessionTimeoutType Number
    Which session timeout applies: by inactivity or at a fixed time.
    smartAccessRiskThreshold Number
    Risk score above which SmartAccess acts.
    socialSignIn Boolean
    Allow social sign-in.
    systemUseNotification String
    Text of the system use notification.
    termsAndConditions Property Map
    Terms users must accept before signing in. Applies to user policies only.
    thirdPartyDeviceTrust Boolean
    Require a third-party device trust check.
    trackInactiveUsers Boolean
    Track users who have not logged in recently.
    trustedDeviceLoginEnabled Boolean
    Allow login from trusted devices.
    trustedDeviceLoginMfaAllowed Boolean
    Allow MFA on trusted device login.
    twitter Boolean
    Allow sign-in with Twitter.
    userPhoneUpdateAllowed Boolean
    Let users change their registered phone number.
    voluntaryMfaRegistrationEnabled Boolean
    Make factor registration voluntary rather than required. See mfa_registration_enabled.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Policies resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    IsDefault bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    Id string
    The provider-assigned unique ID for this managed resource.
    IsDefault bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    id string
    The provider-assigned unique ID for this managed resource.
    is_default bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    id String
    The provider-assigned unique ID for this managed resource.
    isDefault Boolean
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    id string
    The provider-assigned unique ID for this managed resource.
    isDefault boolean
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    id str
    The provider-assigned unique ID for this managed resource.
    is_default bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    id String
    The provider-assigned unique ID for this managed resource.
    isDefault Boolean
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.

    Look up Existing Policies Resource

    Get an existing Policies resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: PoliciesState, opts?: CustomResourceOptions): Policies
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        admin_policy_id: Optional[float] = None,
        allow_add_company_app: Optional[bool] = None,
        allow_add_personal_app: Optional[bool] = None,
        app_force_authn_offset: Optional[float] = None,
        app_otp_offset: Optional[float] = None,
        app_otp_offset_enabled: Optional[bool] = None,
        authentication_factor_ids: Optional[Sequence[float]] = None,
        browser_cert_required: Optional[bool] = None,
        browser_pki_expiration: Optional[float] = None,
        disable_browser_password_manager: Optional[bool] = None,
        disable_protect_push_notifications: Optional[bool] = None,
        disable_protect_push_recovery: Optional[bool] = None,
        dynamic_blacklist_attributes: Optional[str] = None,
        enable_browser_extensions: Optional[bool] = None,
        enable_email_hint: Optional[bool] = None,
        enable_email_password_reset: Optional[bool] = None,
        enable_number_match: Optional[bool] = None,
        enable_password_change: Optional[bool] = None,
        enable_question_password_reset: Optional[bool] = None,
        enable_smart_access: Optional[bool] = None,
        enable_sms_password_reset: Optional[bool] = None,
        enable_system_use_notification: Optional[bool] = None,
        enable_unlock_via_password_reset: Optional[bool] = None,
        enforce_account_password_blacklist: Optional[bool] = None,
        enforce_compromised_credentials_check: Optional[bool] = None,
        euba_enabled: Optional[bool] = None,
        euba_risk_threshold: Optional[float] = None,
        facebook: Optional[bool] = None,
        force_authn: Optional[bool] = None,
        gdt_required: Optional[bool] = None,
        google: Optional[bool] = None,
        ignore_xff: Optional[bool] = None,
        invite_expiration_time_unit: Optional[float] = None,
        invite_expiration_time_value: Optional[float] = None,
        ip_addr_restriction: Optional[str] = None,
        is_default: Optional[bool] = None,
        kind: Optional[str] = None,
        linkedin: Optional[bool] = None,
        lock_effective_minutes: Optional[float] = None,
        maximum_invalid_login_attempts: Optional[float] = None,
        mfa_registration_enabled: Optional[bool] = None,
        minimum_password_length: Optional[float] = None,
        name: Optional[str] = None,
        new_portal_setting: Optional[str] = None,
        otp_auth_enabled: Optional[bool] = None,
        otp_config: Optional[float] = None,
        otp_security_token_expiration_days: Optional[float] = None,
        otp_trigger_condition: Optional[float] = None,
        password_complexity_requirements: Optional[float] = None,
        password_expiration_days: Optional[float] = None,
        password_redirect_enabled: Optional[bool] = None,
        password_redirect_message: Optional[str] = None,
        password_redirect_url: Optional[str] = None,
        passwords_remembered: Optional[float] = None,
        persistent_session_enabled: Optional[bool] = None,
        policies_id: Optional[str] = None,
        preferred_auth_state_machine: Optional[float] = None,
        profile_policy_id: Optional[float] = None,
        require_security_questions: Optional[bool] = None,
        reset_password_authentication_factor_ids: Optional[Sequence[float]] = None,
        secure_admin: Optional[bool] = None,
        secure_area_otp_timeout_minutes: Optional[float] = None,
        secure_profile: Optional[bool] = None,
        self_install_cert: Optional[bool] = None,
        session_timeout_by_fixed_time_unit: Optional[float] = None,
        session_timeout_by_fixed_time_value: Optional[float] = None,
        session_timeout_by_inactivity_unit: Optional[float] = None,
        session_timeout_by_inactivity_value: Optional[float] = None,
        session_timeout_minutes: Optional[float] = None,
        session_timeout_type: Optional[float] = None,
        smart_access_risk_threshold: Optional[float] = None,
        social_sign_in: Optional[bool] = None,
        system_use_notification: Optional[str] = None,
        terms_and_conditions: Optional[PoliciesTermsAndConditionsArgs] = None,
        third_party_device_trust: Optional[bool] = None,
        track_inactive_users: Optional[bool] = None,
        trusted_device_login_enabled: Optional[bool] = None,
        trusted_device_login_mfa_allowed: Optional[bool] = None,
        twitter: Optional[bool] = None,
        user_phone_update_allowed: Optional[bool] = None,
        voluntary_mfa_registration_enabled: Optional[bool] = None) -> Policies
    func GetPolicies(ctx *Context, name string, id IDInput, state *PoliciesState, opts ...ResourceOption) (*Policies, error)
    public static Policies Get(string name, Input<string> id, PoliciesState? state, CustomResourceOptions? opts = null)
    public static Policies get(String name, Output<String> id, PoliciesState state, CustomResourceOptions options)
    resources:  _:    type: onelogin:Policies    get:      id: ${id}
    import {
  to = onelogin_policies.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AdminPolicyId double
    App policy that governs step-up authentication for the admin area.
    AllowAddCompanyApp bool
    Let users add company apps to their portal.
    AllowAddPersonalApp bool
    Let users add personal apps to their portal.
    AppForceAuthnOffset double
    Minutes before force_authn applies again.
    AppOtpOffset double
    Minutes an app MFA prompt is remembered.
    AppOtpOffsetEnabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    AuthenticationFactorIds List<double>
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    BrowserCertRequired bool
    Require a browser certificate.
    BrowserPkiExpiration double
    Days a browser certificate stays valid.
    DisableBrowserPasswordManager bool
    Stop the browser offering to save passwords.
    DisableProtectPushNotifications bool
    Turn off OneLogin Protect push notifications.
    DisableProtectPushRecovery bool
    Turn off OneLogin Protect push recovery.
    DynamicBlacklistAttributes string
    User attributes whose values may not appear in a password.
    EnableBrowserExtensions bool
    Allow the OneLogin browser extension.
    EnableEmailHint bool
    Prefill the email field on the login page.
    EnableEmailPasswordReset bool
    Offer password reset by email.
    EnableNumberMatch bool
    Require number matching on push notifications.
    EnablePasswordChange bool
    Let users change their own password.
    EnableQuestionPasswordReset bool
    Offer password reset by security question.
    EnableSmartAccess bool
    Enable SmartAccess risk scoring.
    EnableSmsPasswordReset bool
    Offer password reset by SMS.
    EnableSystemUseNotification bool
    Show a system use notification before login.
    EnableUnlockViaPasswordReset bool
    Unlock a locked account when the user resets their password.
    EnforceAccountPasswordBlacklist bool
    Reject passwords on the account's blacklist.
    EnforceCompromisedCredentialsCheck bool
    Check credentials against known breaches.
    EubaEnabled bool
    Enable end-user behaviour analytics.
    EubaRiskThreshold double
    Risk score above which EUBA acts.
    Facebook bool
    Allow sign-in with Facebook.
    ForceAuthn bool
    Force re-authentication when the app is opened.
    GdtRequired bool
    Require OneLogin Desktop for this app.
    Google bool
    Allow sign-in with Google.
    IgnoreXff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    InviteExpirationTimeUnit double
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    InviteExpirationTimeValue double
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    IpAddrRestriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    IsDefault bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    Kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    Linkedin bool
    Allow sign-in with LinkedIn.
    LockEffectiveMinutes double
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    MaximumInvalidLoginAttempts double
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    MfaRegistrationEnabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    MinimumPasswordLength double
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    Name string
    Name of the policy.
    NewPortalSetting string
    Access to the new portal: required, allowed or forbidden.
    OtpAuthEnabled bool
    Require multi-factor authentication.
    OtpConfig double
    Which factors MFA accepts.
    OtpSecurityTokenExpirationDays double
    Days a remembered MFA device stays trusted. 1 to 99999.
    OtpTriggerCondition double
    When MFA is triggered.
    PasswordComplexityRequirements double
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    PasswordExpirationDays double
    Days before a password expires. 0 never expires.
    PasswordRedirectEnabled bool
    Send password changes to an external URL instead.
    PasswordRedirectMessage string
    Message shown alongside the password redirect.
    PasswordRedirectUrl string
    URL to send password changes to. Required when password_redirect_enabled is true.
    PasswordsRemembered double
    How many previous passwords cannot be reused. 0, 3 or 5.
    PersistentSessionEnabled bool
    Let sessions survive a browser restart.
    PoliciesId string
    The policy ID.
    PreferredAuthStateMachine double
    Login flow the policy prefers.
    ProfilePolicyId double
    App policy that governs step-up authentication for the profile area.
    RequireSecurityQuestions bool
    Require users to set security questions.
    ResetPasswordAuthenticationFactorIds List<double>
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    SecureAdmin bool
    Require step-up authentication to reach the admin area.
    SecureAreaOtpTimeoutMinutes double
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    SecureProfile bool
    Require step-up authentication to reach the user profile area.
    SelfInstallCert bool
    Let users install their own browser certificate.
    SessionTimeoutByFixedTimeUnit double
    Unit for session_timeout_by_fixed_time_value.
    SessionTimeoutByFixedTimeValue double
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    SessionTimeoutByInactivityUnit double
    Unit for session_timeout_by_inactivity_value.
    SessionTimeoutByInactivityValue double
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    SessionTimeoutMinutes double
    Session length in minutes, in the older single-value format.
    SessionTimeoutType double
    Which session timeout applies: by inactivity or at a fixed time.
    SmartAccessRiskThreshold double
    Risk score above which SmartAccess acts.
    SocialSignIn bool
    Allow social sign-in.
    SystemUseNotification string
    Text of the system use notification.
    TermsAndConditions PoliciesTermsAndConditions
    Terms users must accept before signing in. Applies to user policies only.
    ThirdPartyDeviceTrust bool
    Require a third-party device trust check.
    TrackInactiveUsers bool
    Track users who have not logged in recently.
    TrustedDeviceLoginEnabled bool
    Allow login from trusted devices.
    TrustedDeviceLoginMfaAllowed bool
    Allow MFA on trusted device login.
    Twitter bool
    Allow sign-in with Twitter.
    UserPhoneUpdateAllowed bool
    Let users change their registered phone number.
    VoluntaryMfaRegistrationEnabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    AdminPolicyId float64
    App policy that governs step-up authentication for the admin area.
    AllowAddCompanyApp bool
    Let users add company apps to their portal.
    AllowAddPersonalApp bool
    Let users add personal apps to their portal.
    AppForceAuthnOffset float64
    Minutes before force_authn applies again.
    AppOtpOffset float64
    Minutes an app MFA prompt is remembered.
    AppOtpOffsetEnabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    AuthenticationFactorIds []float64
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    BrowserCertRequired bool
    Require a browser certificate.
    BrowserPkiExpiration float64
    Days a browser certificate stays valid.
    DisableBrowserPasswordManager bool
    Stop the browser offering to save passwords.
    DisableProtectPushNotifications bool
    Turn off OneLogin Protect push notifications.
    DisableProtectPushRecovery bool
    Turn off OneLogin Protect push recovery.
    DynamicBlacklistAttributes string
    User attributes whose values may not appear in a password.
    EnableBrowserExtensions bool
    Allow the OneLogin browser extension.
    EnableEmailHint bool
    Prefill the email field on the login page.
    EnableEmailPasswordReset bool
    Offer password reset by email.
    EnableNumberMatch bool
    Require number matching on push notifications.
    EnablePasswordChange bool
    Let users change their own password.
    EnableQuestionPasswordReset bool
    Offer password reset by security question.
    EnableSmartAccess bool
    Enable SmartAccess risk scoring.
    EnableSmsPasswordReset bool
    Offer password reset by SMS.
    EnableSystemUseNotification bool
    Show a system use notification before login.
    EnableUnlockViaPasswordReset bool
    Unlock a locked account when the user resets their password.
    EnforceAccountPasswordBlacklist bool
    Reject passwords on the account's blacklist.
    EnforceCompromisedCredentialsCheck bool
    Check credentials against known breaches.
    EubaEnabled bool
    Enable end-user behaviour analytics.
    EubaRiskThreshold float64
    Risk score above which EUBA acts.
    Facebook bool
    Allow sign-in with Facebook.
    ForceAuthn bool
    Force re-authentication when the app is opened.
    GdtRequired bool
    Require OneLogin Desktop for this app.
    Google bool
    Allow sign-in with Google.
    IgnoreXff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    InviteExpirationTimeUnit float64
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    InviteExpirationTimeValue float64
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    IpAddrRestriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    IsDefault bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    Kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    Linkedin bool
    Allow sign-in with LinkedIn.
    LockEffectiveMinutes float64
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    MaximumInvalidLoginAttempts float64
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    MfaRegistrationEnabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    MinimumPasswordLength float64
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    Name string
    Name of the policy.
    NewPortalSetting string
    Access to the new portal: required, allowed or forbidden.
    OtpAuthEnabled bool
    Require multi-factor authentication.
    OtpConfig float64
    Which factors MFA accepts.
    OtpSecurityTokenExpirationDays float64
    Days a remembered MFA device stays trusted. 1 to 99999.
    OtpTriggerCondition float64
    When MFA is triggered.
    PasswordComplexityRequirements float64
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    PasswordExpirationDays float64
    Days before a password expires. 0 never expires.
    PasswordRedirectEnabled bool
    Send password changes to an external URL instead.
    PasswordRedirectMessage string
    Message shown alongside the password redirect.
    PasswordRedirectUrl string
    URL to send password changes to. Required when password_redirect_enabled is true.
    PasswordsRemembered float64
    How many previous passwords cannot be reused. 0, 3 or 5.
    PersistentSessionEnabled bool
    Let sessions survive a browser restart.
    PoliciesId string
    The policy ID.
    PreferredAuthStateMachine float64
    Login flow the policy prefers.
    ProfilePolicyId float64
    App policy that governs step-up authentication for the profile area.
    RequireSecurityQuestions bool
    Require users to set security questions.
    ResetPasswordAuthenticationFactorIds []float64
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    SecureAdmin bool
    Require step-up authentication to reach the admin area.
    SecureAreaOtpTimeoutMinutes float64
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    SecureProfile bool
    Require step-up authentication to reach the user profile area.
    SelfInstallCert bool
    Let users install their own browser certificate.
    SessionTimeoutByFixedTimeUnit float64
    Unit for session_timeout_by_fixed_time_value.
    SessionTimeoutByFixedTimeValue float64
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    SessionTimeoutByInactivityUnit float64
    Unit for session_timeout_by_inactivity_value.
    SessionTimeoutByInactivityValue float64
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    SessionTimeoutMinutes float64
    Session length in minutes, in the older single-value format.
    SessionTimeoutType float64
    Which session timeout applies: by inactivity or at a fixed time.
    SmartAccessRiskThreshold float64
    Risk score above which SmartAccess acts.
    SocialSignIn bool
    Allow social sign-in.
    SystemUseNotification string
    Text of the system use notification.
    TermsAndConditions PoliciesTermsAndConditionsArgs
    Terms users must accept before signing in. Applies to user policies only.
    ThirdPartyDeviceTrust bool
    Require a third-party device trust check.
    TrackInactiveUsers bool
    Track users who have not logged in recently.
    TrustedDeviceLoginEnabled bool
    Allow login from trusted devices.
    TrustedDeviceLoginMfaAllowed bool
    Allow MFA on trusted device login.
    Twitter bool
    Allow sign-in with Twitter.
    UserPhoneUpdateAllowed bool
    Let users change their registered phone number.
    VoluntaryMfaRegistrationEnabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    admin_policy_id number
    App policy that governs step-up authentication for the admin area.
    allow_add_company_app bool
    Let users add company apps to their portal.
    allow_add_personal_app bool
    Let users add personal apps to their portal.
    app_force_authn_offset number
    Minutes before force_authn applies again.
    app_otp_offset number
    Minutes an app MFA prompt is remembered.
    app_otp_offset_enabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    authentication_factor_ids list(number)
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browser_cert_required bool
    Require a browser certificate.
    browser_pki_expiration number
    Days a browser certificate stays valid.
    disable_browser_password_manager bool
    Stop the browser offering to save passwords.
    disable_protect_push_notifications bool
    Turn off OneLogin Protect push notifications.
    disable_protect_push_recovery bool
    Turn off OneLogin Protect push recovery.
    dynamic_blacklist_attributes string
    User attributes whose values may not appear in a password.
    enable_browser_extensions bool
    Allow the OneLogin browser extension.
    enable_email_hint bool
    Prefill the email field on the login page.
    enable_email_password_reset bool
    Offer password reset by email.
    enable_number_match bool
    Require number matching on push notifications.
    enable_password_change bool
    Let users change their own password.
    enable_question_password_reset bool
    Offer password reset by security question.
    enable_smart_access bool
    Enable SmartAccess risk scoring.
    enable_sms_password_reset bool
    Offer password reset by SMS.
    enable_system_use_notification bool
    Show a system use notification before login.
    enable_unlock_via_password_reset bool
    Unlock a locked account when the user resets their password.
    enforce_account_password_blacklist bool
    Reject passwords on the account's blacklist.
    enforce_compromised_credentials_check bool
    Check credentials against known breaches.
    euba_enabled bool
    Enable end-user behaviour analytics.
    euba_risk_threshold number
    Risk score above which EUBA acts.
    facebook bool
    Allow sign-in with Facebook.
    force_authn bool
    Force re-authentication when the app is opened.
    gdt_required bool
    Require OneLogin Desktop for this app.
    google bool
    Allow sign-in with Google.
    ignore_xff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    invite_expiration_time_unit number
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    invite_expiration_time_value number
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ip_addr_restriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    is_default bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    linkedin bool
    Allow sign-in with LinkedIn.
    lock_effective_minutes number
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximum_invalid_login_attempts number
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfa_registration_enabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimum_password_length number
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name string
    Name of the policy.
    new_portal_setting string
    Access to the new portal: required, allowed or forbidden.
    otp_auth_enabled bool
    Require multi-factor authentication.
    otp_config number
    Which factors MFA accepts.
    otp_security_token_expiration_days number
    Days a remembered MFA device stays trusted. 1 to 99999.
    otp_trigger_condition number
    When MFA is triggered.
    password_complexity_requirements number
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    password_expiration_days number
    Days before a password expires. 0 never expires.
    password_redirect_enabled bool
    Send password changes to an external URL instead.
    password_redirect_message string
    Message shown alongside the password redirect.
    password_redirect_url string
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwords_remembered number
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistent_session_enabled bool
    Let sessions survive a browser restart.
    policies_id string
    The policy ID.
    preferred_auth_state_machine number
    Login flow the policy prefers.
    profile_policy_id number
    App policy that governs step-up authentication for the profile area.
    require_security_questions bool
    Require users to set security questions.
    reset_password_authentication_factor_ids list(number)
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secure_admin bool
    Require step-up authentication to reach the admin area.
    secure_area_otp_timeout_minutes number
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secure_profile bool
    Require step-up authentication to reach the user profile area.
    self_install_cert bool
    Let users install their own browser certificate.
    session_timeout_by_fixed_time_unit number
    Unit for session_timeout_by_fixed_time_value.
    session_timeout_by_fixed_time_value number
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    session_timeout_by_inactivity_unit number
    Unit for session_timeout_by_inactivity_value.
    session_timeout_by_inactivity_value number
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    session_timeout_minutes number
    Session length in minutes, in the older single-value format.
    session_timeout_type number
    Which session timeout applies: by inactivity or at a fixed time.
    smart_access_risk_threshold number
    Risk score above which SmartAccess acts.
    social_sign_in bool
    Allow social sign-in.
    system_use_notification string
    Text of the system use notification.
    terms_and_conditions object
    Terms users must accept before signing in. Applies to user policies only.
    third_party_device_trust bool
    Require a third-party device trust check.
    track_inactive_users bool
    Track users who have not logged in recently.
    trusted_device_login_enabled bool
    Allow login from trusted devices.
    trusted_device_login_mfa_allowed bool
    Allow MFA on trusted device login.
    twitter bool
    Allow sign-in with Twitter.
    user_phone_update_allowed bool
    Let users change their registered phone number.
    voluntary_mfa_registration_enabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    adminPolicyId Double
    App policy that governs step-up authentication for the admin area.
    allowAddCompanyApp Boolean
    Let users add company apps to their portal.
    allowAddPersonalApp Boolean
    Let users add personal apps to their portal.
    appForceAuthnOffset Double
    Minutes before force_authn applies again.
    appOtpOffset Double
    Minutes an app MFA prompt is remembered.
    appOtpOffsetEnabled Boolean
    Remember an app MFA prompt for app_otp_offset minutes.
    authenticationFactorIds List<Double>
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browserCertRequired Boolean
    Require a browser certificate.
    browserPkiExpiration Double
    Days a browser certificate stays valid.
    disableBrowserPasswordManager Boolean
    Stop the browser offering to save passwords.
    disableProtectPushNotifications Boolean
    Turn off OneLogin Protect push notifications.
    disableProtectPushRecovery Boolean
    Turn off OneLogin Protect push recovery.
    dynamicBlacklistAttributes String
    User attributes whose values may not appear in a password.
    enableBrowserExtensions Boolean
    Allow the OneLogin browser extension.
    enableEmailHint Boolean
    Prefill the email field on the login page.
    enableEmailPasswordReset Boolean
    Offer password reset by email.
    enableNumberMatch Boolean
    Require number matching on push notifications.
    enablePasswordChange Boolean
    Let users change their own password.
    enableQuestionPasswordReset Boolean
    Offer password reset by security question.
    enableSmartAccess Boolean
    Enable SmartAccess risk scoring.
    enableSmsPasswordReset Boolean
    Offer password reset by SMS.
    enableSystemUseNotification Boolean
    Show a system use notification before login.
    enableUnlockViaPasswordReset Boolean
    Unlock a locked account when the user resets their password.
    enforceAccountPasswordBlacklist Boolean
    Reject passwords on the account's blacklist.
    enforceCompromisedCredentialsCheck Boolean
    Check credentials against known breaches.
    eubaEnabled Boolean
    Enable end-user behaviour analytics.
    eubaRiskThreshold Double
    Risk score above which EUBA acts.
    facebook Boolean
    Allow sign-in with Facebook.
    forceAuthn Boolean
    Force re-authentication when the app is opened.
    gdtRequired Boolean
    Require OneLogin Desktop for this app.
    google Boolean
    Allow sign-in with Google.
    ignoreXff Boolean
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    inviteExpirationTimeUnit Double
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    inviteExpirationTimeValue Double
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ipAddrRestriction String
    Newline-separated list of allowed IP addresses or CIDR ranges.
    isDefault Boolean
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    kind String
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    linkedin Boolean
    Allow sign-in with LinkedIn.
    lockEffectiveMinutes Double
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximumInvalidLoginAttempts Double
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfaRegistrationEnabled Boolean
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimumPasswordLength Double
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name String
    Name of the policy.
    newPortalSetting String
    Access to the new portal: required, allowed or forbidden.
    otpAuthEnabled Boolean
    Require multi-factor authentication.
    otpConfig Double
    Which factors MFA accepts.
    otpSecurityTokenExpirationDays Double
    Days a remembered MFA device stays trusted. 1 to 99999.
    otpTriggerCondition Double
    When MFA is triggered.
    passwordComplexityRequirements Double
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    passwordExpirationDays Double
    Days before a password expires. 0 never expires.
    passwordRedirectEnabled Boolean
    Send password changes to an external URL instead.
    passwordRedirectMessage String
    Message shown alongside the password redirect.
    passwordRedirectUrl String
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwordsRemembered Double
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistentSessionEnabled Boolean
    Let sessions survive a browser restart.
    policiesId String
    The policy ID.
    preferredAuthStateMachine Double
    Login flow the policy prefers.
    profilePolicyId Double
    App policy that governs step-up authentication for the profile area.
    requireSecurityQuestions Boolean
    Require users to set security questions.
    resetPasswordAuthenticationFactorIds List<Double>
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secureAdmin Boolean
    Require step-up authentication to reach the admin area.
    secureAreaOtpTimeoutMinutes Double
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secureProfile Boolean
    Require step-up authentication to reach the user profile area.
    selfInstallCert Boolean
    Let users install their own browser certificate.
    sessionTimeoutByFixedTimeUnit Double
    Unit for session_timeout_by_fixed_time_value.
    sessionTimeoutByFixedTimeValue Double
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    sessionTimeoutByInactivityUnit Double
    Unit for session_timeout_by_inactivity_value.
    sessionTimeoutByInactivityValue Double
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    sessionTimeoutMinutes Double
    Session length in minutes, in the older single-value format.
    sessionTimeoutType Double
    Which session timeout applies: by inactivity or at a fixed time.
    smartAccessRiskThreshold Double
    Risk score above which SmartAccess acts.
    socialSignIn Boolean
    Allow social sign-in.
    systemUseNotification String
    Text of the system use notification.
    termsAndConditions PoliciesTermsAndConditions
    Terms users must accept before signing in. Applies to user policies only.
    thirdPartyDeviceTrust Boolean
    Require a third-party device trust check.
    trackInactiveUsers Boolean
    Track users who have not logged in recently.
    trustedDeviceLoginEnabled Boolean
    Allow login from trusted devices.
    trustedDeviceLoginMfaAllowed Boolean
    Allow MFA on trusted device login.
    twitter Boolean
    Allow sign-in with Twitter.
    userPhoneUpdateAllowed Boolean
    Let users change their registered phone number.
    voluntaryMfaRegistrationEnabled Boolean
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    adminPolicyId number
    App policy that governs step-up authentication for the admin area.
    allowAddCompanyApp boolean
    Let users add company apps to their portal.
    allowAddPersonalApp boolean
    Let users add personal apps to their portal.
    appForceAuthnOffset number
    Minutes before force_authn applies again.
    appOtpOffset number
    Minutes an app MFA prompt is remembered.
    appOtpOffsetEnabled boolean
    Remember an app MFA prompt for app_otp_offset minutes.
    authenticationFactorIds number[]
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browserCertRequired boolean
    Require a browser certificate.
    browserPkiExpiration number
    Days a browser certificate stays valid.
    disableBrowserPasswordManager boolean
    Stop the browser offering to save passwords.
    disableProtectPushNotifications boolean
    Turn off OneLogin Protect push notifications.
    disableProtectPushRecovery boolean
    Turn off OneLogin Protect push recovery.
    dynamicBlacklistAttributes string
    User attributes whose values may not appear in a password.
    enableBrowserExtensions boolean
    Allow the OneLogin browser extension.
    enableEmailHint boolean
    Prefill the email field on the login page.
    enableEmailPasswordReset boolean
    Offer password reset by email.
    enableNumberMatch boolean
    Require number matching on push notifications.
    enablePasswordChange boolean
    Let users change their own password.
    enableQuestionPasswordReset boolean
    Offer password reset by security question.
    enableSmartAccess boolean
    Enable SmartAccess risk scoring.
    enableSmsPasswordReset boolean
    Offer password reset by SMS.
    enableSystemUseNotification boolean
    Show a system use notification before login.
    enableUnlockViaPasswordReset boolean
    Unlock a locked account when the user resets their password.
    enforceAccountPasswordBlacklist boolean
    Reject passwords on the account's blacklist.
    enforceCompromisedCredentialsCheck boolean
    Check credentials against known breaches.
    eubaEnabled boolean
    Enable end-user behaviour analytics.
    eubaRiskThreshold number
    Risk score above which EUBA acts.
    facebook boolean
    Allow sign-in with Facebook.
    forceAuthn boolean
    Force re-authentication when the app is opened.
    gdtRequired boolean
    Require OneLogin Desktop for this app.
    google boolean
    Allow sign-in with Google.
    ignoreXff boolean
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    inviteExpirationTimeUnit number
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    inviteExpirationTimeValue number
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ipAddrRestriction string
    Newline-separated list of allowed IP addresses or CIDR ranges.
    isDefault boolean
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    kind string
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    linkedin boolean
    Allow sign-in with LinkedIn.
    lockEffectiveMinutes number
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximumInvalidLoginAttempts number
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfaRegistrationEnabled boolean
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimumPasswordLength number
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name string
    Name of the policy.
    newPortalSetting string
    Access to the new portal: required, allowed or forbidden.
    otpAuthEnabled boolean
    Require multi-factor authentication.
    otpConfig number
    Which factors MFA accepts.
    otpSecurityTokenExpirationDays number
    Days a remembered MFA device stays trusted. 1 to 99999.
    otpTriggerCondition number
    When MFA is triggered.
    passwordComplexityRequirements number
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    passwordExpirationDays number
    Days before a password expires. 0 never expires.
    passwordRedirectEnabled boolean
    Send password changes to an external URL instead.
    passwordRedirectMessage string
    Message shown alongside the password redirect.
    passwordRedirectUrl string
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwordsRemembered number
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistentSessionEnabled boolean
    Let sessions survive a browser restart.
    policiesId string
    The policy ID.
    preferredAuthStateMachine number
    Login flow the policy prefers.
    profilePolicyId number
    App policy that governs step-up authentication for the profile area.
    requireSecurityQuestions boolean
    Require users to set security questions.
    resetPasswordAuthenticationFactorIds number[]
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secureAdmin boolean
    Require step-up authentication to reach the admin area.
    secureAreaOtpTimeoutMinutes number
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secureProfile boolean
    Require step-up authentication to reach the user profile area.
    selfInstallCert boolean
    Let users install their own browser certificate.
    sessionTimeoutByFixedTimeUnit number
    Unit for session_timeout_by_fixed_time_value.
    sessionTimeoutByFixedTimeValue number
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    sessionTimeoutByInactivityUnit number
    Unit for session_timeout_by_inactivity_value.
    sessionTimeoutByInactivityValue number
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    sessionTimeoutMinutes number
    Session length in minutes, in the older single-value format.
    sessionTimeoutType number
    Which session timeout applies: by inactivity or at a fixed time.
    smartAccessRiskThreshold number
    Risk score above which SmartAccess acts.
    socialSignIn boolean
    Allow social sign-in.
    systemUseNotification string
    Text of the system use notification.
    termsAndConditions PoliciesTermsAndConditions
    Terms users must accept before signing in. Applies to user policies only.
    thirdPartyDeviceTrust boolean
    Require a third-party device trust check.
    trackInactiveUsers boolean
    Track users who have not logged in recently.
    trustedDeviceLoginEnabled boolean
    Allow login from trusted devices.
    trustedDeviceLoginMfaAllowed boolean
    Allow MFA on trusted device login.
    twitter boolean
    Allow sign-in with Twitter.
    userPhoneUpdateAllowed boolean
    Let users change their registered phone number.
    voluntaryMfaRegistrationEnabled boolean
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    admin_policy_id float
    App policy that governs step-up authentication for the admin area.
    allow_add_company_app bool
    Let users add company apps to their portal.
    allow_add_personal_app bool
    Let users add personal apps to their portal.
    app_force_authn_offset float
    Minutes before force_authn applies again.
    app_otp_offset float
    Minutes an app MFA prompt is remembered.
    app_otp_offset_enabled bool
    Remember an app MFA prompt for app_otp_offset minutes.
    authentication_factor_ids Sequence[float]
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browser_cert_required bool
    Require a browser certificate.
    browser_pki_expiration float
    Days a browser certificate stays valid.
    disable_browser_password_manager bool
    Stop the browser offering to save passwords.
    disable_protect_push_notifications bool
    Turn off OneLogin Protect push notifications.
    disable_protect_push_recovery bool
    Turn off OneLogin Protect push recovery.
    dynamic_blacklist_attributes str
    User attributes whose values may not appear in a password.
    enable_browser_extensions bool
    Allow the OneLogin browser extension.
    enable_email_hint bool
    Prefill the email field on the login page.
    enable_email_password_reset bool
    Offer password reset by email.
    enable_number_match bool
    Require number matching on push notifications.
    enable_password_change bool
    Let users change their own password.
    enable_question_password_reset bool
    Offer password reset by security question.
    enable_smart_access bool
    Enable SmartAccess risk scoring.
    enable_sms_password_reset bool
    Offer password reset by SMS.
    enable_system_use_notification bool
    Show a system use notification before login.
    enable_unlock_via_password_reset bool
    Unlock a locked account when the user resets their password.
    enforce_account_password_blacklist bool
    Reject passwords on the account's blacklist.
    enforce_compromised_credentials_check bool
    Check credentials against known breaches.
    euba_enabled bool
    Enable end-user behaviour analytics.
    euba_risk_threshold float
    Risk score above which EUBA acts.
    facebook bool
    Allow sign-in with Facebook.
    force_authn bool
    Force re-authentication when the app is opened.
    gdt_required bool
    Require OneLogin Desktop for this app.
    google bool
    Allow sign-in with Google.
    ignore_xff bool
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    invite_expiration_time_unit float
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    invite_expiration_time_value float
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ip_addr_restriction str
    Newline-separated list of allowed IP addresses or CIDR ranges.
    is_default bool
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    kind str
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    linkedin bool
    Allow sign-in with LinkedIn.
    lock_effective_minutes float
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximum_invalid_login_attempts float
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfa_registration_enabled bool
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimum_password_length float
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name str
    Name of the policy.
    new_portal_setting str
    Access to the new portal: required, allowed or forbidden.
    otp_auth_enabled bool
    Require multi-factor authentication.
    otp_config float
    Which factors MFA accepts.
    otp_security_token_expiration_days float
    Days a remembered MFA device stays trusted. 1 to 99999.
    otp_trigger_condition float
    When MFA is triggered.
    password_complexity_requirements float
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    password_expiration_days float
    Days before a password expires. 0 never expires.
    password_redirect_enabled bool
    Send password changes to an external URL instead.
    password_redirect_message str
    Message shown alongside the password redirect.
    password_redirect_url str
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwords_remembered float
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistent_session_enabled bool
    Let sessions survive a browser restart.
    policies_id str
    The policy ID.
    preferred_auth_state_machine float
    Login flow the policy prefers.
    profile_policy_id float
    App policy that governs step-up authentication for the profile area.
    require_security_questions bool
    Require users to set security questions.
    reset_password_authentication_factor_ids Sequence[float]
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secure_admin bool
    Require step-up authentication to reach the admin area.
    secure_area_otp_timeout_minutes float
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secure_profile bool
    Require step-up authentication to reach the user profile area.
    self_install_cert bool
    Let users install their own browser certificate.
    session_timeout_by_fixed_time_unit float
    Unit for session_timeout_by_fixed_time_value.
    session_timeout_by_fixed_time_value float
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    session_timeout_by_inactivity_unit float
    Unit for session_timeout_by_inactivity_value.
    session_timeout_by_inactivity_value float
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    session_timeout_minutes float
    Session length in minutes, in the older single-value format.
    session_timeout_type float
    Which session timeout applies: by inactivity or at a fixed time.
    smart_access_risk_threshold float
    Risk score above which SmartAccess acts.
    social_sign_in bool
    Allow social sign-in.
    system_use_notification str
    Text of the system use notification.
    terms_and_conditions PoliciesTermsAndConditionsArgs
    Terms users must accept before signing in. Applies to user policies only.
    third_party_device_trust bool
    Require a third-party device trust check.
    track_inactive_users bool
    Track users who have not logged in recently.
    trusted_device_login_enabled bool
    Allow login from trusted devices.
    trusted_device_login_mfa_allowed bool
    Allow MFA on trusted device login.
    twitter bool
    Allow sign-in with Twitter.
    user_phone_update_allowed bool
    Let users change their registered phone number.
    voluntary_mfa_registration_enabled bool
    Make factor registration voluntary rather than required. See mfa_registration_enabled.
    adminPolicyId Number
    App policy that governs step-up authentication for the admin area.
    allowAddCompanyApp Boolean
    Let users add company apps to their portal.
    allowAddPersonalApp Boolean
    Let users add personal apps to their portal.
    appForceAuthnOffset Number
    Minutes before force_authn applies again.
    appOtpOffset Number
    Minutes an app MFA prompt is remembered.
    appOtpOffsetEnabled Boolean
    Remember an app MFA prompt for app_otp_offset minutes.
    authenticationFactorIds List<Number>
    IDs of the authentication factors this policy accepts. Setting it replaces the whole list; setting it to [] clears it. Applies to both kinds.
    browserCertRequired Boolean
    Require a browser certificate.
    browserPkiExpiration Number
    Days a browser certificate stays valid.
    disableBrowserPasswordManager Boolean
    Stop the browser offering to save passwords.
    disableProtectPushNotifications Boolean
    Turn off OneLogin Protect push notifications.
    disableProtectPushRecovery Boolean
    Turn off OneLogin Protect push recovery.
    dynamicBlacklistAttributes String
    User attributes whose values may not appear in a password.
    enableBrowserExtensions Boolean
    Allow the OneLogin browser extension.
    enableEmailHint Boolean
    Prefill the email field on the login page.
    enableEmailPasswordReset Boolean
    Offer password reset by email.
    enableNumberMatch Boolean
    Require number matching on push notifications.
    enablePasswordChange Boolean
    Let users change their own password.
    enableQuestionPasswordReset Boolean
    Offer password reset by security question.
    enableSmartAccess Boolean
    Enable SmartAccess risk scoring.
    enableSmsPasswordReset Boolean
    Offer password reset by SMS.
    enableSystemUseNotification Boolean
    Show a system use notification before login.
    enableUnlockViaPasswordReset Boolean
    Unlock a locked account when the user resets their password.
    enforceAccountPasswordBlacklist Boolean
    Reject passwords on the account's blacklist.
    enforceCompromisedCredentialsCheck Boolean
    Check credentials against known breaches.
    eubaEnabled Boolean
    Enable end-user behaviour analytics.
    eubaRiskThreshold Number
    Risk score above which EUBA acts.
    facebook Boolean
    Allow sign-in with Facebook.
    forceAuthn Boolean
    Force re-authentication when the app is opened.
    gdtRequired Boolean
    Require OneLogin Desktop for this app.
    google Boolean
    Allow sign-in with Google.
    ignoreXff Boolean
    Ignore the X-Forwarded-For header when matching ip_addr_restriction.
    inviteExpirationTimeUnit Number
    Unit for invite_expiration_time_value: 0 minutes, 1 hours, 2 days.
    inviteExpirationTimeValue Number
    How long an invite link stays valid, in invite_expiration_time_unit units. Must be greater than 0.
    ipAddrRestriction String
    Newline-separated list of allowed IP addresses or CIDR ranges.
    isDefault Boolean
    Whether this is the account's default user policy. Read-only: which policy is the default belongs to the account and is set elsewhere, and a policy cannot stop being the default except by another policy becoming it.
    kind String
    Either user or app. Changing it replaces the policy, because the API refuses to move an existing one between kinds.
    linkedin Boolean
    Allow sign-in with LinkedIn.
    lockEffectiveMinutes Number
    Minutes an account stays locked. 15, 30, 60, or 0 to require an admin.
    maximumInvalidLoginAttempts Number
    Failed logins before lockout. 3 to 10, or 0 for no limit.
    mfaRegistrationEnabled Boolean
    Prompt users to register a factor. Combined with voluntary_mfa_registration_enabled: true/false is required, true/true voluntary, false/false not prompted.
    minimumPasswordLength Number
    Minimum password length. One of 5, 6, 8, 10, 12 or 16.
    name String
    Name of the policy.
    newPortalSetting String
    Access to the new portal: required, allowed or forbidden.
    otpAuthEnabled Boolean
    Require multi-factor authentication.
    otpConfig Number
    Which factors MFA accepts.
    otpSecurityTokenExpirationDays Number
    Days a remembered MFA device stays trusted. 1 to 99999.
    otpTriggerCondition Number
    When MFA is triggered.
    passwordComplexityRequirements Number
    Password complexity: 0 none, 1 letters and digits, 2 mixed case and digits, 3 mixed case, digits and special characters, 4 any three of those four.
    passwordExpirationDays Number
    Days before a password expires. 0 never expires.
    passwordRedirectEnabled Boolean
    Send password changes to an external URL instead.
    passwordRedirectMessage String
    Message shown alongside the password redirect.
    passwordRedirectUrl String
    URL to send password changes to. Required when password_redirect_enabled is true.
    passwordsRemembered Number
    How many previous passwords cannot be reused. 0, 3 or 5.
    persistentSessionEnabled Boolean
    Let sessions survive a browser restart.
    policiesId String
    The policy ID.
    preferredAuthStateMachine Number
    Login flow the policy prefers.
    profilePolicyId Number
    App policy that governs step-up authentication for the profile area.
    requireSecurityQuestions Boolean
    Require users to set security questions.
    resetPasswordAuthenticationFactorIds List<Number>
    IDs of the authentication factors accepted for password reset. Applies to user policies only.
    secureAdmin Boolean
    Require step-up authentication to reach the admin area.
    secureAreaOtpTimeoutMinutes Number
    Minutes a step-up authentication lasts. One of 5, 10, 15, 20, 30, 45 or 60.
    secureProfile Boolean
    Require step-up authentication to reach the user profile area.
    selfInstallCert Boolean
    Let users install their own browser certificate.
    sessionTimeoutByFixedTimeUnit Number
    Unit for session_timeout_by_fixed_time_value.
    sessionTimeoutByFixedTimeValue Number
    Fixed session length, in session_timeout_by_fixed_time_unit units.
    sessionTimeoutByInactivityUnit Number
    Unit for session_timeout_by_inactivity_value.
    sessionTimeoutByInactivityValue Number
    Inactivity timeout, in session_timeout_by_inactivity_unit units.
    sessionTimeoutMinutes Number
    Session length in minutes, in the older single-value format.
    sessionTimeoutType Number
    Which session timeout applies: by inactivity or at a fixed time.
    smartAccessRiskThreshold Number
    Risk score above which SmartAccess acts.
    socialSignIn Boolean
    Allow social sign-in.
    systemUseNotification String
    Text of the system use notification.
    termsAndConditions Property Map
    Terms users must accept before signing in. Applies to user policies only.
    thirdPartyDeviceTrust Boolean
    Require a third-party device trust check.
    trackInactiveUsers Boolean
    Track users who have not logged in recently.
    trustedDeviceLoginEnabled Boolean
    Allow login from trusted devices.
    trustedDeviceLoginMfaAllowed Boolean
    Allow MFA on trusted device login.
    twitter Boolean
    Allow sign-in with Twitter.
    userPhoneUpdateAllowed Boolean
    Let users change their registered phone number.
    voluntaryMfaRegistrationEnabled Boolean
    Make factor registration voluntary rather than required. See mfa_registration_enabled.

    Supporting Types

    PoliciesTermsAndConditions, PoliciesTermsAndConditionsArgs

    Content string

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    Enabled bool
    Whether the terms are shown and must be accepted.
    Content string

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    Enabled bool
    Whether the terms are shown and must be accepted.
    content string

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    enabled bool
    Whether the terms are shown and must be accepted.
    content String

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    enabled Boolean
    Whether the terms are shown and must be accepted.
    content string

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    enabled boolean
    Whether the terms are shown and must be accepted.
    content str

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    enabled bool
    Whether the terms are shown and must be accepted.
    content String

    Text of the terms.

    Every remaining argument is optional, and OneLogin supplies a default for most of them. An argument you do not set keeps whatever value the API reports, so the plan stays empty rather than showing a diff for a default you never chose. The consequence is that removing an argument from your configuration does not reset it — state keeps the last value OneLogin returned and nothing is sent. To undo a setting, set it explicitly to the value you want.

    enabled Boolean
    Whether the terms are shown and must be accepted.

    Import

    Policies are imported by ID:

    $ pulumi import onelogin:index/policies:Policies engineering 123456

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    onelogin onelogin/terraform-provider-onelogin
    License
    Notes
    This Pulumi package is based on the onelogin Terraform Provider.
    onelogin logo onelogin logo
    Viewing docs for onelogin 1.5.0
    published on Friday, Aug 28, 2026 by onelogin
    Schema (JSON)
    onelogin/terraform-provider-onelogin

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial