Define the sign-in policy

The sign-in policy decides when the service requires a second factor and when it refuses a sign-in: by scope and sign-in method, and by network, person, Windows group, country, network operator, program, and time of day. For example: “administration only with a second factor,” “keys from outside only with a code,” “SQL logins never from outside,” or “data access only from Germany.”

In the Anmelderichtlinie (Sign-in policy) area, on the Anmelderegeln (Sign-in rules) tab, each rule appears as an entry in the tree, with its conditions and exceptions underneath. You edit a rule in the Anmelderegel (Sign-in rule) dialog, which saves the rule with all its conditions and exceptions in a single step. Every matching rule counts, and a refusal overrides everything else; the order doesn't matter. If no rule matches, the person's rights alone decide.

Using a template (for the common cases): Open Anmelderichtlinie and choose a template under Weitere (More). For the first two, the app asks for your company network (for example, 10.0.0.0/8; separate several with commas) and suggests the networks your rules already name:

Each template saves its rules and networks in a single step. If you apply a template again, for example with a different company network, it updates its own rules (recognized by the label “Vorlage: …”, Template: …) instead of adding new ones; anything you added to them yourself, such as exceptions, stays. Afterward, check a person under Personen und Schlüssel (People and keys) > Rechte (Rights) > Anmeldung und Rechte … (Sign-in and rights …).

Manually:

1. Open Anmelderichtlinie, go to the Anmelderegeln tab, and choose Neu (New). To open an existing rule, double-click it or choose Bearbeiten (Edit); double-clicking a condition opens its rule. Löschen (Delete) deletes the selected rule together with its exceptions.

2. At the top, choose what the rule does:

   Field	Values	Meaning
   Wirkung (Effect)	require a second factor (RequireTotp), refuse (Deny)	second factor required, or sign-in refused
   Bereich (Scope)	data access and administration (All), data access (Data), administration (Admin)	everything, only the data interfaces, or only administration
   Anmeldeverfahren (Sign-in method)	any sign-in method (Any), personal key (PersonalKey), Windows account (Windows), SQL login with password (SqlLogin), service key (ApiKey)	which sign-in method the rule applies to
   Notiz (Note)	text	a note for you; has no effect
   Modus (Mode)	try first (Report), enforce (Enforce)	whether the rule decides or only shows what it would do; see step 6

   You pick the values from lists in German, with the technical value in parentheses; below the mode, a line explains what the selected option does.

3. Under Gilt nur für (Applies only to), set which requests the rule applies to; under Gilt nicht für (Doesn't apply to), set which ones it permanently leaves out. Choose Hinzufügen … (Add), then the kind and the value:

   Kind	Value	How the service knows it
   Netz (Network)	a network such as 10.0.0.0/8, or the name of one of the service's own networks	from the request's address
   Person	from the list of people	from the person's personal key, Windows account, or SQL login
   Windows-Gruppe (Windows group)	name or SID	only for sign-ins with a Windows account
   Land (Country)	from the list of countries	observed: derived from the address; a VPN or a mobile network moves it
   Netzbetreiber (Network operator)	an autonomous system such as AS3320; the list shows the operators the sign-in log has seen	observed: derived from the address
   Programm (Program)	for example Power Query, WinHTTP, Browser, PowerShell	claimed: any program can send any name
   Zeitfenster (Time window)	days and a from–to time, for example Mon–Fri 06:00–20:00	the service's clock in its own time zone, not UTC

   Within one kind, one value is enough; across kinds, all of them have to match. With nothing under Gilt nur für, the rule applies to every request. The app checks a value before it takes it, for example a country code against the list.

4. If the rule shouldn't apply to certain cases for a while, choose Neue Ausnahme … (New exception): a note, an end in UTC or Ohne Ende (No end), and the conditions. An exception exempts only requests that match all of its conditions at once, for example “Frank Mustermann from Thailand until November 2.” It needs at least one condition or an end. An expired exception no longer exempts anyone and stays in place until you remove it.
5. Under Was die Regel tut (What the rule does), read the plain-language summary. If the rule could refuse your own sign-in to administration, a red warning appears above the buttons.

6. Choose Speichern (Save). The app saves the rule with its conditions and exceptions in a single step.

   A new rule starts as Erst erproben (Try first): the service evaluates it at every sign-in, but it doesn't decide anything. The Erprobung (Trial) tab shows, for each rule and version, how many sign-ins it would have hit, from how many people and origins, and how many of them an exception would have exempted; individual sign-ins appear in the Anmeldungen (Sign-ins) area on the Ereignisse (Events) tab, marked “nur Probe” (trial only). If the result looks right, select the rule on the Erprobung tab and choose Weitere (More) > Erprobte Regel durchsetzen … (Enforce tried rule), or open the rule and set Modus to Durchsetzen (Enforce). The app enforces a refusal that also reaches administration only after asking you.

Result: An enforced rule applies from the next sign-in on. In the tree, the rule shows its conditions (“Nur für …”, only for; “Nicht für …”, not for) and its exceptions with their end underneath; a rule on trial is marked “(Probe)” (trial).

Examples

• An unknown origin counts as “anywhere.” If the service can't determine where a request comes from, every rule applies to it. If the service sits behind a proxy, the proxy has to be registered as trusted in the configuration (Security:TrustedProxies); otherwise, the service sees only the proxy.
• Country and network operator are hints, not proof. A VPN, a proxy, or a mobile network moves the origin. A country or network operator that can't be determined, and a request that names no program, fall within the rule and don't match any exception. The service's own networks and private networks have no country and no network operator, so exclude your company network by Netz (Network), not by country.
• A program as the only condition of an exception exempts anyone who sends that name. Combine it with people, networks, or an end; the app warns you about it.
• Service keys have no second factor, so only Deny is allowed for them.
• Programs without a sign-in dialog (Excel, Power BI) can't prompt for a code. For them, the only option is a read-only key with Ohne zweiten Faktor (Without second factor); see Create a person and issue a key.
• Don't lock yourself out: A Deny rule for Admin shuts you out too. Try a new rule first and test it with a second sign-in before you sign out. The way back in is described in Regain access when administration is locked out (data service documentation).
• Rules from the file (Regeln aus der Datei (Rules from the file) tab): If the service's configuration file still contains sign-in rules (Gateway:Security:SignInRules), the page lists them on this tab. They do not apply: with an administration store, only the rules on the Anmelderegeln (Sign-in rules) tab apply; the entries in the file only served as a starting point, and the service warns about them at startup. Remove them from the file on the server; the tab then disappears.

• Settings (Einstellungen (Settings) tab): Each setting has its own field with its unit and a line on what it does. An empty field means the value from the service's configuration applies. Change the fields and choose Speichern (Save); Verwerfen (Discard) shows the saved values again. A value outside the range is rejected.

  Field (name in the service)	Meaning	Default, range
  Gültigkeit einer Anmeldung mit Code (Validity of a sign-in with code) (totp_session_hours)	how long a session lasts after a code is accepted	10 hours, 1 to 168
  Frist zum Einrichten des zweiten Faktors (Deadline to set up the second factor) (totp_enrol_hours)	how long after a key is issued the person can set up their second factor themselves; see Set up or reset the second factor	24 hours, 0 = never
  Name der Installation (Installation name) (installation_name)	the name under which authenticator apps list the second factor; see Change the installation name	the name from the installation
  Laufzeit selbst ausgestellter Schlüssel (Lifetime of self-issued keys) (self_service_key_days)	lets people issue keys to themselves (lifetime in days)	0 = off
  Gültigkeit eines Einmal-Links (Validity of a one-time link) (mail_link_hours)	how long a one-time link sent by email stays valid; see Send an invitation by email	72 hours, 1 to 720
  Höchstdauer einer Freischaltung (Maximum activation) (max_activation_hours)	the longest activation for an on-demand key; see Issue a presentation key and replace a lost key	12 hours

  The service defines the values and limits (HTTP: administration (reference), entity set Settings (data service documentation)) and rejects any value outside them.

• Set up or reset the second factor
• Set up a person's access by location
• Reference: HTTP: sign-in (reference), section “Sign-in policy and second factor” (data service documentation)