Sign in
Catalog / Hands-on lab

Lab: Build conditional access policies

Your own Monosign v2026.10 server with staff, administrators, users at risk and an emergency account. Build a layered policy set and watch real sign-ins from different countries and networks get denied, challenged or allowed.

Monosign University Pass 1 hIntermediate DE · EN · ES · TR Administrator Security analyst

Version 5 · updated Nov 12, 2026What changed?

Hands-on lab
Sign in to start

Included with University Pass.

What you will learn

  • Translate access requirements into prioritized Monosign policies and verify them
  • Explain why policy order and scope decide who is affected, and keep an admin path open

Your lab environment

YOUR LAB SERVERYour browserAdmin, then breakglass in aprivate windowManagementPolicies, authenticators,workflowsStaff and groupsAll Staff with lisa.staff;Administrators withadam.adminAccountRuns the policies on everysign-inIdentity riskrita.risk High, carl.riskCriticalLab inboxE-mail and SMS codesEmergency accountbreakglass; Security approvalworkflow, sam.securityapprovesBuilds the policiesSecond factor code
Your lab environment: the policies you build in Management decide each sign-in on Account, using groups, network, country and identity risk

Lab tasks

Each task is checked automatically against the real state of your lab environment.

  1. 1. Deny sign-ins from North Korea and Iran for the All Staff group
  2. 2. Require a passkey as second factor for the Administrators group
  3. 3. Require an e-mail code for All Staff outside the office range 10.20.0.0/16, while a blocked country still wins
  4. 4. Deny access at Critical identity risk and require a passkey at High
  5. 5. Hold the breakglass account's sign-ins for approval by the security team, and try it