---
title: "Update your FIDO policy to check for app integrity"
slug: "dpo-update-fido-policy-to-check-for-app-integrity"
updated: 2026-10-27T20:13:12Z
published: 2026-10-27T20:13:12Z
canonical: "docs.onespan.com/dpo-update-fido-policy-to-check-for-app-integrity"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update your FIDO policy to check for app integrity

A single FIDO policy can check the app integrity in iOS apps using Apple’s app integrity service, and that same FIDO policy can check the app integrity in Android apps using Google’s Play Integrity service. A single FIDO policy can also cover both UAF and FIDO2 protocols.

## UAF protocol

You can only update a draft policy. If the policy that you want to modify is active, then copy the policy and make your modifications. A policy must be active in order to be used.

1. In the Admin Console, login and, if needed, switch to the desired tenant. Navigate to **Authentication > FIDO Policies**.
2. On the **Policies** page, copy the active policy you want to modify. In the **Actions** column for that policy, click ![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/image1(23).png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D) (copy). The **Policy Details** page opens, rename your new policy.

> In addition to letters and digits, only the following characters are allowed in a policy name: hyphen (-), forward slash (/), underscore (_) and space ( ).
3. Find the **FIDO UAF Authenticators** panel. **Allow FIDO UAF Authenticators** must be checked in order to create or modify a UAF FIDO policy. Check the **Request App Attest Credential** and/or check the **Request Google Play Integrity Extension** checkbox.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/Screenshot 2026-04-24 at 9.20.41 AM.png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D)

1. Optional. To *require* App Integrity for the UAF protocol, add a Post Operation Rule to your policy.

a. Under **Post Operation Rules** click **Add Rule**. Fill in the ***Rule Name** field, with something like “Require App Integrity for UAF”. b. On the Post Operation Rule dialog box, set the **Action** to **Deny,** click **Add Post Operation Check** and set the condition to read “If App Integrity is not known”.

c. Still on the Post Operation Rule dialog box, click **Add Post Operation Check** again and set the condition to read “**or** App Integrity is not acceptable”. Click **Save Rule**. ![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/UAFRequireintegrity.png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D)
2. Optional. To increment the [risk score](/dpoa/docs/data-used-by-adaptive-rules-and-fido-policies#risk-scores) because a user doesn’t have app integrity when using the UAF protocol, add a different Post Operation Rule to your policy.

a. Under **Post Operation Rules** click **Add Rule**. Fill in the ***Rule Name** field, with something like “Increment Risk Score for missing App Integrity when using UAF”. b. On the Post Operation Rule dialog box, set the **Action** to **Increment risk score** and choose the amount to add to the risk score. Click **Add Post Operation Check** and set the condition to read “If App Integrity is not known”.

c. Still on the Post Operation Rule dialog box, click **Add Post Operation Check** again and set the condition to read “**or** App Integrity is not acceptable”. Click **Save Rule**.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/Screenshot 2026-04-29 at 9.57.27 AM.png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D)

## FIDO2/WebAuthn protocol

1. Back at the Policy Details page, scroll down to the **FIDO2/WebAuthn Authenticators** panel. **Allow FIDO FIDO2/UAF Authenticators** must be checked in order to create or modify a FIDO2 FIDO policy. Check the **Request App Attest Credential** and/or check the **Request Google Play Integrity Extension** checkbox.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/Screenshot 2026-04-24 at 9.24.50 AM.png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D)
2. Optional. To *require* App Integrity for the UAF protocol, add a Post Operation Rule to your policy.

a. Under **Post Operation Rules** click **Add Rule.** Fill in the ***Rule Name** field, with something like “Require App Integrity for FIDO2”. b. On the Post Operation Rule dialog box, set the **Action** to **Deny,** click **Add Post Operation Check** and set the condition to read “If App Integrity is not known”.

c. Still on the Post Operation Rule dialog box, click **Add Post Operation Check** again and set the condition to read “**or** App Integrity is not acceptable”. Click **Save Rule**.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/Screenshot 2026-04-16 at 1.56.38 PM.png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D)
3. Optional. To increment the [risk score](/dpoa/docs/data-used-by-adaptive-rules-and-fido-policies#risk-scores) because a user doesn’t have app integrity when using the FIDO2 protocol, add a different Post Operation Rule to your FIDO policy.

a. Under **Post Operation Rules** click **Add Rule**. Fill in the ***Rule Name** field, with something like “Increment Risk Score for missing App Integrity when using FIDO2”. b. On the Post Operation Rule dialog box, set the **Action** to **Increment risk score** and choose the amount to add to the risk score. Click **Add Post Operation Check** and set the condition to read “If App Integrity is not known”.

c. Still on the Post Operation Rule dialog box, click **Add Post Operation Check** again and set the condition to read “**or** App Integrity is not acceptable”. Click **Save Rule**.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/Screenshot 2026-04-29 at 10.02.03 AM.png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D)
4. Save your policy.
5. To activate your policy, on the **Policies** page, look for the row containing your policy. Click ![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/image10(12).png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A42%3A00Z&se=2026-10-29T02%3A42%3A00Z&sr=c&sp=r&sig=fWLnlw%2F%2B5VqiiWHtI4dkHl2HOL9KXB%2BEXRpAYEjnUrA%3D) (activate) in the **Actions** column.