RBA

Applies Risk-Based Authentication policies. Evaluates configured risk factors (City, Country, IP, Browser, Device) against the user's login context. Returns true if no risk is detected, false if a risk factor triggers.

Logic & Flow Node

Node Card

RBA

true

false

Error edges

4007

Category: Logic & Flow Nodes

Type: rba

Typical position: After the Auth node's true output, before issuing a final access token, to step up authentication when a risk factor fires.

---

Properties

Property	Type	Required	Description
Select RBA Policies	multiselect	Yes	Risk factors to evaluate. Options: City, Country, IP, Browser, Device.
City Attribute	selectinput	Conditional	Shown when City is selected. Configure expiry as Expires After Day(s) or Expires After Count Reaches To.
City Risk Notification	multiselect	Conditional	Shown when City is selected. Options: Admin Notification, User Notification.
Country Attribute	selectinput	Conditional	Shown when Country is selected. Same expiry options as City.
Country Risk Notification	multiselect	Conditional	Shown when Country is selected.
IP Attribute	selectinput	Conditional	Shown when IP is selected. Same expiry options.
IP Risk Notification	multiselect	Conditional	Shown when IP is selected.
Browser Attribute	selectinput	Conditional	Shown when Browser is selected. Same expiry options.
Browser Risk Notification	multiselect	Conditional	Shown when Browser is selected.
Device Attribute	selectinput	Conditional	Shown when Device is selected. Same expiry options.
Device Risk Notification	multiselect	Conditional	Shown when Device is selected.
Error Handling	custommultiselect	No	Override default messages for specific error codes. Each selected error code becomes a named output edge on the canvas.

Outputs & Errors

Output / Code	Condition	Default message
true	No risk factors triggered for this login context	NA
false	One or more risk factors triggered	NA
4007	Identity not found in the directory	User does not exist

note

Each risk factor can be configured to send email notifications to the Admin and/or the User when triggered. Notifications are sent at the time of the risk event, independent of the workflow's output path.

---

Common Next Nodes

RBA (true)→Success Finalno risk detected: grant access

RBA (false)→MFA Configured Staterisk detected: step-up with MFA challenge

Usage Notes

RBA compares the current login context (city, country, IP, browser fingerprint, device) against the user's known trusted values. On the false output, route users to a step-up authentication path (typically an MFA challenge) before granting access. Configure notification policies on each factor to alert security teams or users when anomalous logins are detected.