---
locale: "en"
updated_at: "2026-04-21T13:33:49.889Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/reference/core-concepts/access-policies"
---

# Access policies

Overview of policy logic and enforcement principles.

## Why access policies matter

Access policies let administrators move beyond “all-or-nothing” network access. With UserLock, you can:

- Enforce [MFA](/userlock/docs/reference/access-policies/mfa) for stronger authentication.
- Apply contextual restrictions ([time](/userlock/docs/reference/access-policies/time-restriction), [geolocation](/userlock/docs/reference/access-policies/geolocation), [machine](/userlock/docs/reference/access-policies/machine-restriction)).
- Limit the number of [concurrent sessions](/userlock/docs/reference/access-policies/session-limit).
- Control access with permanent or [temporary](/userlock/docs/reference/access-policies/temporary-policies) policies.
- Generate [alerts and notifications](/userlock/docs/reference/access-policies/notifications) when rules are triggered.

This enables fine-grained control of user access while ensuring policies can adapt to exceptional situations (e.g., temporary access during leave, extended hours for special projects).

## Types of policies

- **Permanent policies**: Apply indefinitely until modified or deleted.
- **Temporary policies**: Active only for a specified period. These can be used to allow exceptions (e.g., working outside usual hours) or to temporarily deny access (e.g., while on leave).

## Policy priority management

Because users may belong to several policies, UserLock applies a priority system to resolve conflicts based on the following criterias:

|  |  |
| --- | --- |
| Policy type | Temporary policies always override permanent policies. |
| Target type | User policies override Group or OU policies. |
| Server-wide policy setting | Defines how to handle ties between equal-priority policies:  - **Least restrictive (default)**: If at least one policy allows access, it is granted. - **Most restrictive**: If any policy denies access, it is denied. |

### Priority levels (highest to lowest)

1. User temporary policy
2. Group/OU temporary policy
3. User permanent policy
4. Group/OU permanent policy

### Examples of priority resolution

#### Temporary vs. Permanent

- Alice is in a permanent group policy (“Everyone”) allowing 1 workstation session.
- She is also in a temporary group policy (“Everyone”) allowing 3 sessions.
- Result: The temporary rule applies → Alice can open 3 sessions.

#### Two permanent group policies

- Bob is in a permanent group policy (“Everyone”) allowing 1 session.
- He is also in another permanent group policy (“Group-A”) allowing 2 sessions.
- Both rules are permanent group-level policies (same priority level).
- Result: The applied rule depends on the **server-wide policy** (most restrictive = 1; least restrictive = 2).

#### Temporary and permanent group policies

- Carol is in a permanent group policy (“Group-A”) allowing 2 sessions.
- She also is in a temporary group policy (“Group-B”) allowing 5 sessions.
- Result: Carol can open 5 sessions.
- Add a temporary policy for “Group-A” allowing 3 sessions.
- Result: The applied rule depends on the **server-wide policy** (most restrictive = 3; least restrictive = 5).

#### User vs. Group/OU

- Alice has a permanent user policy allowing 2 sessions.
- She is also in a permanent group policy allowing 1 session.
- Result: The user policy wins → Alice can open 2 sessions.
- Bob has a temporary user policy allowing 2 sessions.
- He is also in a temporary group policy (“Group-A”) allowing 1 session.
- Result: The user policy wins → Bob can open 2 sessions.

## Synchronization with Active Directory

UserLock continuously tracks AD group and OU memberships to ensure policies are always up to date.

When applying restrictions, UserLock checks which policies apply to the user.

- The membership list is refreshed **every 5 minutes**.
- Creating or deleting a policy applies to active sessions within **5 minutes**.
- Changes to policies are applied without requiring users to reconnect.

👉 Example: If an admin creates a new temporary policy to allow access outside normal hours, the user does not need to disconnect / reconnect to apply the modification.

> **Note**
>
> The **Domain Users**, **Everyone**, and **Authenticated Users** groups always include all users in the domain, even if specific accounts were removed from these groups. Microsoft also recommends n**ever removing accounts from Domain Users**, since it is the primary group.

## Summary

UserLock access policies give administrators precise, flexible control over network access:

- Apply **MFA and contextual restrictions** (time, location, machine, session limits).
- Use **permanent** policies for baseline security, and **temporary** policies for exceptions.
- Synchronization with AD ensures policies stay accurate and up-to-date.
- Rules are applied immediately, with conflicts resolved by a clear **priority system**.

This framework ensures that user access remains both **secure** and **adaptable** to organizational needs.