- Deny rules are always evaluated first, and if any of the conditions are met, all subsequent rule types (approve, obligate) are ignored.
- Approve rules are evaluated after deny conditions are checked, if any of the conditions are met, all subsequent rule types (obligate) are ignored.
- Obligation rules are evaluated last, and if any match, the user will be obligated per the matched rule.
If no conditions are met, the Default Rule (located at very bottom of policy) is invoked.
Go to Verification Services > "your service" > Policy:
Click and Drag the ordered list icon on the left-hand side of your rules to change their order.
Updated 3 months ago