Configure Device Restriction Policy

Enforce device enrollment limits by user group or username to reduce unauthorized device sprawl and strengthen authentication governance across your 1Kosmos community

---

A Device Restriction Policy defines how many devices of each type a user can enroll for authentication. Policies are applied by group membership, username, or both — giving administrators precise control over device enrollment without enforcing a single rule across all users.

How It Works

When a policy is active, 1Kosmos enforces the Max Allowed count for each configured device type. Users who reach their limit can continue using existing enrolled devices but cannot register new ones until an existing device is removed.

If a device type is not included in a policy, its allowed count is considered 0 — meaning users covered by that policy cannot enroll devices of that type.

If multiple policies apply to the same user, the most restrictive policy for each device type takes effect independently.

Example:

• Policy 1 allows 3 Smartphones, 1 Platform Authenticator, 1 Orion Authenticator
• Policy 2 allows 1 Smartphone, 2 Platform Authenticators

The user is allowed: 1 Smartphone (Policy 2), 1 Platform Authenticator (Policy 1), 0 Orion Authenticators, 0 Security Keys.

Device Restriction Policies govern future enrollment only. Existing enrolled devices are not affected when a policy is created or updated. If a user already has more devices than the policy allows, the restriction applies the next time they try to add a new device.

Before You Begin

Only Community Administrators can create and manage Device Restriction Policies.

For group-based policies, ensure the following are in place before creating a policy:

• Group information is available from Active Directory or Microsoft Entra.
• User Attribute Mapping is configured to capture the key-value pair corresponding to user groups.

To navigate to Device Restriction Policies

1. Sign in to AdminX.
2. Go to Authentication > Device Restriction Policy.

All configured policies are listed with their name, conditions, allowed devices, and status.

Create a Device Restriction Policy

1. Click Create New.
2. Enter a Policy Name.
3. The Enabled toggle is on by default. Turn it off to save the policy without activating it.
4. Under Conditions, define who the policy applies to. You can add one or both condition types:

   1. Group — Enter AD group names. Select is one of or is not one of and add one or more group values.
   2. Username — Enter specific usernames. Select is one of or is not one of and add one or more values.
   3. Click + to add values to a condition. Click Add another to add a second condition row. Multiple conditions are applied using logical AND.
5. Under Allowed Device, select a Device Type and set the Max Allowed count. Add additional device types as needed.
6. Click Save. The policy is enforced immediately after saving.

Use a Username condition when AD groups are not available or when you need a more restrictive policy for specific users.

Device Type	Description	Min Allowed	Max Allowed
Smart Phones	1Kosmos mobile app	1	3
Platform Authenticator	Security key on Windows Hello and macOS	1	2
Security Key	1Key and security keys on Android/iOS	1	3
Orion Authenticator	Orion-based authentication	1	2

Edit a Policy

1. On the Device Restriction Policy page, click the edit icon in the Actions column.
2. Update the configuration and click Save.

Changes take effect immediately after saving.

Disable a Policy

Disabling a policy pauses enforcement while keeping the policy definition intact. Users previously covered by this policy will fall back to the next applicable policy, or to default device restrictions if no other policy applies.

1. Click the edit icon for the policy.
2. Turn off the Enabled toggle.
3. Click Save.

Delete a Policy

1. Click the delete icon in the Actions column.
2. Confirm the deletion.

Deleting a policy removes all restrictions it enforced. Users previously covered will fall back to the next applicable policy or to default device restrictions.

Note: Deleted policies are permanently removed and cannot be recovered.

Audit Events

Device Restriction Policy actions are logged under Reports > Event Logs.

Event	Description
E_DEVICE_POLICY_CREATED	A new Device Restriction Policy was created
E_DEVICE_POLICY_UPDATED	An existing policy was modified
E_DEVICE_POLICY_DELETED	A policy was permanently deleted