Name: Configuring Risk-Based Authentication in SAP Customer Data Cloud
Uploaded: 2022-10-10
Duration: 366 s
Description: In this video, you will learn how to implement Risk-Based Authentication, or RBA, Global Rules and Account Rule-Sets in the SAP Customer Data Cloud Console.

Share feedback

<p>Planned maintenance of Practice Systems</p>

Planned maintenance of Practice Systems

Why create an SAP account?

Enhance your learning experience

SAP Learning

Subscribe now

Learn more

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

<div><div><div><div><div>In this video, you will learn how to implement Risk-Based Authentication, or RBA, Global Rules and Account Rule-Sets in the SAP Customer Data Cloud Console.<div><br></div><div><br></div><div><br></div></div></div></div></div></div>

Configuring Risk-Based Authentication in SAP Customer Data Cloud

In this Microlearning video, you will learn how to implement Risk-Based Authentication, or RBA, Global Rules and Account Rule-Sets in the SAP Customer Data Cloud Console.  Let’s start with RBA Global Rules. In the CDC console, select Security from under the Identity menu, then select the Risk Based Authentication tab. Click on the Create New Rule button on the right side.  The first step is Templates.  Select the On multiple failed login attempts lockout account template from the list and click on Next.	  For the Flow step, give a name and description of the new rule, and select the CDC flow of the new rule, and select the CDC flow on the right on which to apply the new rule. For the Action step, on the left side, select Global Rule for Rule Type, and ‘And’ for Criteria Relationship.  The ‘On 10 multiple failed login attempts’ criteria is pre-selected from the rule template.  We’ll change the threshold number from 10 to 3.  Under the Account scope checkbox, the Reset Interval is pre-populated with 1 hour from the rule template.  Let’s change it to another amount of time, like 30 minutes, by clicking on the clock icon.   On the right side, the Lock Account RBA action is also pre-selected from the rule template.  You can always change the default lockout period from 600 seconds to a different period of time.  So with these configurations: when 3 failed logins occur for the same account within 30 minutes, the RBA action is triggered and will lockout the account for 10 minutes or 600 seconds.  Click Next.  On the Scope step, we’ll use the default ‘Whole Group’ scope.  Click Next.  In the last step, Rule Overview, we can review the rule configurations.  If something is wrong or needs to be changed, you can go back by selecting previous step buttons at the top.  Otherwise, we’ll keep the Active toggle on and click Save to finish our RBA rule creation. Our new RBA rule should now be listed on the Risk Based Authentication page. Let’s test our new RBA Global Rule by logging in with a wrong password 3 times.   Now the account is temporarily locked for 10 minutes. Back in the console if you go inside Identity Access look for the user and open its record, you’ll notice the Lock Out Boolean flag. Now let’s implement RBA Account Rule-Sets. In the console, we’ll again select Security under the Identity menu of our site.  This time, let’s select the Identity Verification tab.  Under Email Verification, check the box Require email verification and then click Save at the bottom of the page. Now let’s click on	 the Risk Based Authentication tab.  Click on the Create New Rule button.  On the first step, select from the list of templates: On device change force verification of auth level 10 or higher.  Click Next.  On the Flow step, give a name and description to the new rule.  On the right side, select the CDC flow on which to apply the new rule.  Click Next.  On the Action step, everything is already pre-selected.  The default Expiration Period is set in seconds for 30 days, however, let’s set it for one week.  On the right side, the RBA action is also pre-selected to Enforce TFA via email, which is auth level 10.  This configuration means: when the physical device or unique browser used to access  the site changes, or every 7 days, the user is forced to pass the Two-Factor Authentication mechanism associated with authLevel 10 or higher.  Click Next. In the Scope step, use the default Whole Group scope and click Next. On the last step, Rule Overview, we review the rule configurations and if needed, go back, and make any changes.  Let’s keep the Active toggle on and click Save to finish our RBA rule creation. Our new RBA rule is now listed on the Risk Based Authentication page. Next, click on the Authentication tab and select a Verification Method associated for Auth Level 10.  In this case, we’ll check the Email option under Verification Methods at the bottom of the page. Under the Risk Based Authentication tab, click the gear icon on the left side of the Create New Rule button to bring up the account rule-set settings popup.  To allow the end user to enable the usage of a particular Account Rule-Set, like the one we just created, it’s necessary to enable the Account Rule-Set Override for the Admin and End user.  For the new rule to work, we need to select the new rule from the “Default Account Rule-Set” dropdown.  Click Save.  Now let’s test the new RBA Account Rule.  Now the email has been verified. We hope you have enjoyed this demo on implementing RBA Rules .