Risk-Based Authentication and Conditional Authentication, which one takes precedence?

[ddeconin]

Hi,

If I configure risk based authentication & conditional authentication at the same time. Which one takes precedence?

For example,

I configure Conditional Authentication on an IP Address range to forward users within that range to a corporate IDP.

I configure Risk based Authentication to block users if they are not part of a certain IAS group.

Is the user blocked by IAS directly, first forwarded to the corporate IDP and then blocked by IAS after authenticating or not blocked by IAS after authenticating?

[Colt · Accepted solution]

Hi,

Conditional Auth jump in first. After coming back from corp. IdP depending on the config (ID federation enabled and RBA configured) now the rules are evaluated and in case the user is blocked via group assignment, this rule will apply.