When creating Policies, organizations may find it useful to apply restrictions to the Policy. A common type of restriction is a Condition, which provides the organization with the ability to allow or restrict access based on environmental parameters such as:
-
Date & Time: for example, allow weekend activity, restrict access based on time of day, etc.
-
IP: allow or restrict based on a preconfigured IP range
-
Identity Attribute: allow or restrict access based on an attribute associated to the Identity. For example, all users of a specific department; all users within a specific location (country, city, region, etc.); all users with a specific title.
-
Request Attribute: allow or restrict access based on the value of a specific request parameter.
Predefined and Generic Conditions
The Platform supports two kinds of Conditions:
- Predefined Conditions: These are the built-in Date & Time, IP, Identity Attribute, and Request Attribute Conditions. They are available for the Dynamic Authorization Service and for any Application without Generic Condition Templates.
- Generic Conditions: These Conditions use Generic Condition Templates associated with an Application. The templates define which attributes and values you can use. Zscaler currently supports Generic Conditions.
When you create a Condition, the Application you select determines which Condition types you can choose. For more information, see Managing Conditions.
You can create Conditions:
- On the Assets & Conditions tab of the Policies Workspace (formerly Authorization Workspace)
- While creating a new Policy in the Policy Wizard