Risk Policy Template: Managed Machine Login
This article is subject to change as the feature develops and we make improvements.
Restrict login to a web application to workstations that HYPRspeed (Desktop SSO) verifies as managed. A user who signs in from a HYPR-managed workstation completes the login through Desktop SSO. A login from any other device is blocked.
Prerequisites
- Desktop SSO is enabled for the Application; see Workstation SSO
- Users sign in to the Application through the native HYPR login, which requests the policy evaluation before it displays the login methods
How a Login Is Decided
| Device | Result |
|---|---|
| Workstation that completes Desktop SSO | Allowed. The login continues through Desktop SSO without showing the login method menu. |
| Workstation that does not complete Desktop SSO | Blocked, unless the user has an active admin exception for the Application. |
| Mobile browser | Blocked. Admin exceptions do not apply to mobile browsers. |
A user with an active admin exception signs in with the Application's usual login methods.
Configuration Fields
| Field | Description |
|---|---|
| Default duration for admin exceptions | How long an admin exception lasts when the exception does not set its own duration. Default is 30. |
| Duration unit | The unit for Default duration for admin exceptions: Seconds, Minutes, Hours, or Days. Default is Minutes. |
The default duration cannot exceed 7 days.
Assign the Policy
Assign the policy to the Application as described in Policy Assignments, with these settings:
- Evaluation Point: Pre-HYPR Integration. This is the only evaluation point that receives the device signal; do not assign the policy to any other.
- Logging Only Enabled: Turn on to record which logins the policy would block without blocking them. Turn off to enforce the policy.
When the policy is enforced, it alone decides the login: a risk policy assigned to the same Application at Post-HYPR Integration is not evaluated. With Logging Only Enabled turned on, the Post-HYPR Integration policy decides the login as usual.
If Adapt is unavailable, the assignment's Evaluation Response Unavailable Fallback applies.
Grant an Admin Exception
To let a user sign in from a device that is not managed, grant a temporary exception:
- In Control Center, go to HYPR Adapt > User Management.
- Select the Application, then select the Managed Machine Login policy.
- Set the Unblock Duration, up to 7 days.
- Add the users, then submit the queue.
The exception applies only to the selected Application, and ends when its duration elapses. Exceptions granted here always carry their own duration, so the template's default duration does not apply to them.
User Experience
While the policy is enforced, the login page offers no manual sign-in link. While the browser waits for the workstation, the user can click click here to cancel this sign in instead, which ends the attempt. The wait lasts up to the Application's Handoff Timeout; a shorter Handoff Timeout denies a device without HYPR sooner.
A user whose login is blocked on a computer sees an Access denied page:
We could not verify that this device meets your organization's access requirements. Sign in to your computer with HYPR, and if your browser asks to connect to apps on this device, choose Allow (or allow it in the site settings if you blocked it). Then try again. If the issue persists, contact your IT administrator.
Clicking Try again offers Desktop SSO again.
A user on a phone or tablet sees this message instead, with no Try again button:
Your organization only allows sign in from a computer it manages. This app is not available on phones or tablets. Sign in from your work computer instead. If you need help, contact your IT administrator.
Events
The policy records a MANAGED_MACHINE_LOGIN_RESTRICTED action event each time it blocks a login. With Logging Only Enabled turned on, it records the same event for each login it would have blocked.
Each enforced login also records an ADAPT_POLICY_EVALUATION event, or ADAPT_LOGGING_ONLY_POLICY_EVALUATION with Logging Only Enabled turned on, whose message gives the device classification and the reason for the result. Granting an admin exception records an ADAPT_POLICY_EVAL_USER_ALLOWLISTED event. See Audit Trail.