Creating a Bypass MFA policy

FortiIdentity Cloud admins can configure adaptive authentication policies to let end-users using a trusted IP, subnet, or known device bypass MFA within a specified time period. This allows end-users using the trusted IP resource or device to authenticate more easily in their daily work.

To create a Bypass MFA policy for a specific subnet or IP:

1. Go to Settings > Adaptive Auth > Policies.
2. Click Add Policy.
3. Enter a name for the policy.
4. For Action, select Bypass MFA.
5. For Filters, select Subnet Filter.
6. For Subnets, specify the IP or subnet. (Note: The IP and subnet must be supported by FortiProducts).

7. Enable Last MFA and specify a reasonable MFA Interval.

   Note: The valid values range from 1 to 72 hours. If the user logs in from the same subnet within the specified time interval, they can bypass the login process. Once the time interval elapses, the log in status expires.

8. For Schedule, select a schedule set.
9. Click Apply.
10. Add the new policy to a profile.
11. Add the new profile to an application (i.e., FortiProducts, SSO apps, and web apps) and any realms whose users are going to use the specified trusted IPs or subnets.

To create a Bypass MFA policy for a known device:

1. Go to Settings > Adaptive Auth > Policies.
2. Click Add Policy.
3. Enter a name for the policy.
4. For Action, select Bypass MFA.
5. For Filters, select Device Filter.

6. In Auth Interval, set an interval between 5 minutes to 3 days to specify how long bypassing MFA from a specific device remains in effect. Their log in status can be maintained as long as the user remains active from the same device.

   Note: The Auth Interval value must be less than the realm's Forget Device value (in hours).

7. Click Apply.
8. Add the policy to a profile.
9. Add the new profile to any SSO applications whose users you want to bypass authentication.