Assignments and exceptions

Policies are applied through assignments and can be exempted through exceptions. This guide covers how to control which users, groups, and browsers a policy affects.

Profile assignments

A policy must be assigned to at least one profile to be active. Profiles group users and browsers together for policy application.

Adding profiles to a policy

1. Open the policy in the Policy Editor
2. Navigate to the Assignments section
3. Select profiles from the available list
4. Click Save

The policy will now apply to all users and browsers in the selected profiles.

Removing profiles

To remove a policy from a profile:

1. Open the policy in the Policy Editor
2. Navigate to the Assignments section
3. Deselect the profile
4. Click Save

Include/exclude assignments

For more granular control, policies support include/exclude logic for profiles, groups, and individual users.

Include assignments

Specify exactly which profiles, groups, or users the policy applies to:

Profiles

• Select specific profiles the policy should apply to
• Users in any of these profiles will be subject to the policy

Groups

• Select user groups (from your identity provider)
• Users in any of these groups will be subject to the policy

Users

• Specify individual user emails
• These users will be subject to the policy regardless of profile/group membership

Exclude assignments

Exempt specific profiles, groups, or users from the policy:

Profiles

• Users in excluded profiles will not be subject to this policy
• Useful for exempting test or admin profiles

Groups

• Users in excluded groups will not be subject to this policy
• Useful for exempting IT, security, or executive groups

Users

• Specific users who should be exempted
• Useful for individual exceptions

Assignment logic

1. Check if user is in an included profile, group, or user list
2. If yes, check if user is also in an excluded profile, group, or user list
3. Exclude takes precedence — if user matches both include and exclude, they are excluded

Example:

Include Groups: All Employees
Exclude Groups: IT Security Team

Result: All employees except the IT Security Team are subject to the policy.

Exceptions

Exceptions provide temporary or permanent exemptions from a policy for specific users, devices, locations, or profiles.

When to use exceptions vs exclude assignments

Use Case	Exceptions	Exclude Assignments
Temporary exemption	✓ (with expiration)
Permanent exemption	✓	✓
Created from event	✓
Specific URLs/domains	✓
Specific devices	✓
Based on access request	✓

Creating an exception

From the Policy Editor:

1. Open the policy
2. Navigate to the Exceptions section
3. Click Create exception
4. Configure the exception:
   • Locations — Domains or URLs to exempt
   • Users — Specific users to exempt
   • Devices — Specific devices to exempt
   • Browsers — Specific browsers to exempt
   • Profiles — Profiles to exempt
   • Expiration — When the exception ends (optional)
5. Click Save

From an Event:

1. View an event that triggered the policy
2. Click Create exception
3. The exception is pre-populated with event details
4. Adjust as needed and save

From an Access Request:

1. Review a user's access request
2. Approve the request
3. An exception is automatically created

Exception fields

Field	Description
Locations	Domains or URLs exempted (e.g., example.com, https://app.example.com/page)
Users	User emails exempted
Devices	Device identifiers exempted
Browsers	Browser identifiers exempted
Profiles	Profile IDs exempted
Expiration	Date/time when exception expires (empty = permanent)
Label	Optional description for the exception

Exception duration

Exceptions can be:

• Permanent — No expiration, lasts until manually removed
• Temporary — Expires after a set date/time

Temporary exceptions are useful for:

• Allowing access during a specific project
• Granting access for a trial period
• Responding to access requests with time limits

Managing exceptions

View all exceptions for a policy in the Exceptions section of the Policy Editor.

To edit an exception:

1. Click on the exception in the list
2. Modify the fields
3. Click Save

To delete an exception:

1. Click on the exception in the list
2. Click Delete
3. Confirm deletion

Expired exceptions

Expired exceptions are automatically marked but not deleted. You can:

• View expired exceptions for audit purposes
• Renew an expired exception by editing and setting a new expiration
• Delete expired exceptions to clean up

Best practices

Assignment best practices

1. Use profiles for broad groupings — Assign policies to profiles that represent departments or risk levels

2. Use groups for organizational structure — Leverage your identity provider groups

3. Reserve user-level includes for special cases — Individual user assignments are harder to maintain

4. Document exclusions — Use the description field to explain why exclusions exist

Exception best practices

1. Set expirations — Avoid permanent exceptions when temporary will suffice

2. Be specific — Use the most specific scope possible (URL over domain, user over profile)

3. Review regularly — Audit exceptions periodically to remove stale ones

4. Use labels — Add descriptive labels to explain why exceptions exist

5. Prefer exclusions for permanent needs — If a group should always be exempt, use exclude assignments instead of exceptions

Example configurations

Executive exception

Exception:
  Users: ceo@company.com, cfo@company.com
  Expiration: None (permanent)
  Label: Executive exemption - approved by CISO

Temporary project access

Exception:
  Users: contractor@external.com
  Locations: internal-tool.company.com
  Expiration: 2024-03-01 00:00:00
  Label: Project Alpha access - ends March 1

Test profile exclusion

Exclude Assignments:
  Profiles: QA Testing Profile

Department assignment

Include Assignments:
  Groups: Finance Team, Accounting Team
  Profiles: Finance Profile
Exclude Assignments:
  Users: finance-admin@company.com