--- title: "Specifying allowed authenticators for mobile app users" slug: "dpo-authenticate-specifying-allowed-authenticators-for-mobile-app-users" tags: ["S3 v9.5"] updated: 2026-10-27T16:00:39Z published: 2026-10-27T16:00:39Z canonical: "docs.onespan.com/dpo-authenticate-specifying-allowed-authenticators-for-mobile-app-users" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Specifying allowed authenticators for mobile app users Mobile app users can choose how they authenticate into your apps. Depending on their OS or device, they can login using a: - Security Key - Biometric (face or fingerprint) - Passcode - PIN - Yes/No - Watch - Device If you wish users to login in a specific way, you can limit these options by changing which authenticators will be available to them in your FIDO policy. ## Update the default FIDO policy 1. Login to the [DigipassONE Authentication Cloud portal](https://staging.digipassone.com/). 2. Access the **FIDO Policies** page by clicking **Configure server** on the *Authentication Cloud tile* and: - Clicking **Review/Add FIDO Policies** in the *FIDO Policies section*, or - Clicking **FIDO Policies** on the *Authentication menu*. 3. On the **Search** bar, enter *default.* - You will see that there is only one **default** (Default FIDO Policy), which is provisioned along with your tenant. - The default policy is *active*, so it cannot be modified, i.e., if you hover over the edit button, you won't be allowed to click it. However, you should be able to make a copy and modify it. 4. Click the **duplicate** icon. ![FIDO Policies table displaying policy names, statuses, and modification dates for management.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/screenshots-s3-auth-cloud-default-policy-details-3-4.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) 5. You should see a message saying, *Operation completed successfully* — click **OK**. ![Operation completed successfully, draft policy named 'default' created with confirmation button.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/screenshots-s3-auth-cloud-default-policy-details-5.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) 6. You should see the *Policy Details* of the policy you just copied. 7. **FIDO Policy Name**: leave this as *default* so that any changes you make here will overwrite the original default policy. 8. Under *Allowed Authenticator Groups*, you will see: - **Android/iOS Strong Biometric - Hardware** - **Android/iOS Strong Lock Screen - Hardware** - **Android/iOS PIN - Hardware** - **Android/iOS Presence - Hardware** - **Android/iOS Silent - Hardware** 9. In this case, we will prevent mobile users from authenticating using a PIN, so click the **trashbin** next to *Android/iOS PIN - Hardware*. ![FIDO policy details including authenticator groups and options for app attest credentials.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/screenshots-s3-auth-cloud-default-policy-details-6-9.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) 10. Scroll to the bottom of the page and click **Save**. 11. The **FIDO Policies** page should now show two policies named default. The one you created should have a **Status** of *DRAFT* and have the current date under **Modified (UTC +00:00)**. 12. Activate your policy by clicking the *checkmark* under **Actions**. ![FIDO Policies table displaying active and draft policy statuses with action options.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/screenshots-s3-auth-cloud-default-policy-details-11-12.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) 13. You should see a dialog asking you to confirm activation. Click **Activate**. ![Confirmation prompt to activate the default policy, warning about overwriting existing policy.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/screenshots-s3-auth-cloud-default-policy-details-13.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) 14. This will overwrite the original default policy and update your policy's **Status** to *ACTIVE*. Note that changes may take up to *120 seconds* to take effect. ![FIDO Policies table displaying active status and modification date for default policy.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/screenshots-s3-auth-cloud-default-policy-details-14.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) > For more information about specifying allowed authenticators, see [Creating a policy to use platform authenticators](/dpoa/docs/s3suite94-step-3-create-fido-policies-1#creating-a-policy-to-use-platform-authenticators). ## Verify which authenticators are allowed Once you have: - configured the Android or iOS Tutorial App to use the Authentication Cloud, and - updated the default FIDO policy to specify which authenticators are allowed you can use either app to verify which authenticators are available for use. For instance, if you now attempt to register a new authenticator with an Android phone, **PIN** authentication will no longer be displayed in the list of available authentication methods | ![Select an authentication method including PIN, Yes/No, Screen Lock, and Silent ASM.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/s3-cloud-android-authenticators.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) With original default FIDO policy | ![Select an authentication method from the options displayed on the mobile app interface.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/s3-cloud-allowed-android-authenticators.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A12Z&se=2026-10-29T01%3A15%3A12Z&sr=c&sp=r&sig=Uko5Ez1Hvr4QuPoy%2FssHSTNnJ8duf8Scfju6Gdw94MA%3D) With updated default FIDO policy | | --- | --- |