---
locale: "en"
updated_at: "2025-10-28T12:33:00.908Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/reference/access-policies/access-policy-management"
---

# Access policy management

Create, edit, clone, delete, view effective policies.

## Creating an access policy

Access policies apply to machines in the protected zone with the [UserLock agent](/userlock/docs/core-concepts/agents) installed.

- Policies can be created at the **user**, **group**, or **organizational unit (OU)** level.
- In the **Access Policies** pages, clicking a target name opens the list of [configured policies](/userlock/docs/access-policies/policy-management#configured-access-policies) for that target. From there, a new policy can be created using the **Add** button and the [policy wizard](/userlock/docs/getting-started/configure-an-access-policy).

> **Note**
>
> A user can be affected by multiple policies (permanent and/or temporary). The rules applied are determined by the policy [priority system](/userlock/docs/core-concepts/access-policies#policy-priority-management).

## Editing an access policy

Editing can be performed in multiple locations:

- **Access Policies** pages → inline actions → **Edit**.
- **Summary** page → edit icon of the selected policy.
- **User/Group/OU dashboard** → **Access Policies** → **Configured** tab → click the policy.
- Directly after creating a policy in the wizard, by selecting an existing policy to edit.

Editing a policy opens the target dashboard (**Configured** tab) and displays a dialog with the related rules. Modifications are applied after clicking **Save**.

![](https://a.storyblok.com/f/122374/897x608/800fe406bb/policy-iap-editing.png)

## Cloning an access policy

Cloning is available from:

- Inline actions in the **Access Policies** pages.
- The **Configured** tab of a user, group, or OU dashboard.

> **Restrictions**
>
> - Cloning is limited to the same **target type** (user → user, group → group, OU → OU).
> - Cloning is limited to the same **duration type** (permanent → permanent, temporary → temporary).

When cloning, a dialog opens to select the new target (user, group, or OU via LDAP search). The new target’s dashboard then loads with the cloned policy for review and adjustment.

![](https://a.storyblok.com/f/122374/466x336/e681716aea/policy-user-cloning.png)

## Deleting an access policy

Deletion methods depend on the context:

- From a specific policy type page (e.g., MFA, session limits, geolocation): the **Delete** inline action prompts a confirmation before removal.
- From a user, group, or OU dashboard (**Access Policies** → **Configured** tab): the **Delete** action opens a dialog listing all configured policies for that target and duration. Multiple policies can be selected for deletion.

![](https://a.storyblok.com/f/122374/465x418/5734dc5fa3/policy-deleting-dialog.png)

## Configured access policies

### Views

- The **Summary** page lists all configured policies by user, across all policy types (MFA, geolocation, initial access point, etc.).
  ![](https://a.storyblok.com/f/122374/1598x953/724fcc3e0f/access-policies-summary.PNG)
- Dedicated pages exist for each policy type, with prefiltered views.
  ![](https://a.storyblok.com/f/122374/1679x628/ecf6a6f67d/mfa-table.png)

### Indicators

**Temporary policies**: clock icon.

- Active → blue
- Expired or future → gray

**Permanent policies**: infinity icon.

- Active → green
- Inactive → gray

### Order of display

In the **Configured** tab of a user, group, or OU dashboard, policies are listed in their application order. For example:

1. Active temporary policies
2. Permanent policies
3. Future temporary policies

![](https://a.storyblok.com/f/122374/1266x628/8f4ea9c513/configured-policies-future-tempo.png)

## Effective access policies

The **Effective** tab (user dashboards only) displays the access policies that are currently applied to a specific user. 

- This view consolidates rules from user, group, and organizational unit (OU) policies, based on the [policy priority management](/userlock/docs/reference/core-concepts/access-policies#policy-priority-management).
- Access the effective policies by opening the user's dashboard, going to the **Access Policies** tab, and selecting the **Effective** tab.

![](https://a.storyblok.com/f/122374/1301x802/0b74472c2f/effective-restrictions.png)

###

## Temporary access policies

UserLock access policies can be defined for a given period. For more information, see the [temporary policy page](/userlock/docs/reference/access-policies/temporary-policies).