Updating User Access Policy

You can update the user access policy to change the following details:

• Configure a new identity provider.
• Add, modify, or delete a user group and client-role mappings
• Edit organization's network profile, which includes changing default WLAN Wireless Local Area Network. WLAN is a 802.11 standards-based LAN that the users access through a wireless connection. SSID Service Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network. and the organization name.

To update the user access policy, complete the following steps:

1. In the WebUI, set the filter to Global.

   The global dashboard is displayed.

2. Click Security > Authentication & Policy.
3. Click the Config icon.
4. In the User Access Policy section, click the Edit icon to edit an external identity server.
5. Click the  Delete icon in the User Authentication section to delete the existing identity provider, and do one of the following:

   A Confirm Delete pop-up window is displayed to confirm the delete action. Click Confirm to proceed.

   • To configure Google Workspace or Microsoft Entra ID or Okta Workforce Identity Cloud as your identity server, see step 5 in Configuring User Access Policy.

6. To create, edit, and delete the user group to client role mapping, do one of the following:

   • To create a new row in the User Groups to Client Role Mapping table, click the + icon, and do the following:
     1. Select a user group from the drop-down list under User Group.

        The values in this drop-down list are mapped to the user groups that you have created or configured in the identity provider's server.

     2. Select the corresponding client role for the user group from the drop-down list under Client Role.
        • Client Role drop-down list displays roles that are created using Configuring User Roles for IAP Clients.
        • If you delete a client role associated with a user access policy, the user access policy will not work as expected.

   • To edit a user group to client role mapping, do the following:
     1. Select a user group from the drop-down list under User Group.
     2. Select the corresponding client role for the user group from the drop-down list under Client Role.
   • To delete a user group to client role mapping, hover on the specific row and click the icon.

7. To edit the Network Profile section, do the following:

   • In the Organization name field, enter the organization name.
   • Select WLAN SSID from the Connect users to WLAN drop-down list. This WLAN SSID will be set as the default SSID for your network.

   If you delete the selected WLAN SSID from the WLAN configuration, the user access policy will not work as expected.

8. Click Save to save changes, or click Cancel.
   
9. Click User Access Policy accordion to view the updated client access policy.
   

The following animation shows you how to update the user access policy.