All Products
Search

This Product

    Identity as a Service:Enable risk control

    Document Center

    Identity as a Service:Enable risk control

    Last Updated:Jul 18, 2026

    The Customer Identity and Access Management (CIAM) platform provides risk control features for IP addresses, accounts, and passwords to enhance authentication security.

    Overview

    As user numbers and access frequency grow, securing the authentication process becomes critical. CIAM provides risk control features to protect user identities during authentication.

    CIAM provides three categories of risk control:

    • IP-based

    • Account-based

    • Password-based

    IP controls

    IP failure count

    You can limit the number of consecutive authentication failures from a single IP address within a specified time frame. If the number of failures exceeds the limit, the user must enter a CAPTCHA to proceed.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > IP Failures card, you can configure, enable, or disable this feature.

    3. Click Configure to set the parameters for the IP failure count.

    4. Parameter descriptions:

      • Time range: The time frame for counting authentication failures. The default is 5 minutes.

      • Authentication failure count: The maximum number of allowed authentication failures.

      • Enable: Enables or disables the IP failure count feature.

    IP blacklist

    You can configure a global IP blacklist that applies to all applications. The platform denies all requests from IP addresses on this list. This includes API calls for authentication, user management, and administration. Use this feature with caution.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > IP Blacklist card, you can configure and enable or disable the IP blacklist.

    3. Click Configure to set the parameters for the IP blacklist.

    4. Parameter descriptions:

      1. Blacklist IP list: API calls from IP addresses on this list will be rejected if they use any application's Client_ID, Client_Secret, or Access_Token.

      2. Enable: Enables or disables the IP blacklist feature.

    IP whitelist

    You can configure an IP whitelist in the application settings. Once configured, the application accepts requests only from whitelisted IP addresses and denies all others.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > IP Address Whitelist card, you can configure and enable or disable the IP whitelist.

    3. Click Configure Application to set the parameters for the IP whitelist.

    4. In the application list, select the target application and click IP Address Whitelist Configuration.

    5. Parameter descriptions:

      1. IP whitelist: When the whitelist is enabled, the system processes API requests only from IP addresses on this list. If the whitelist is empty, the system allows requests from all IP addresses.

      2. Enable whitelist: Enables or disables the IP whitelist feature.

    Abnormal access location check

    If two consecutive authentication attempts for the same user originate from geographically distinct locations (determined by IP address), IDaaS sends an SMS alert to the user. You must configure an SMS template before enabling this feature.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Check Location Errors card, you can enable or disable the check.

    Account controls

    Brute-force CAPTCHA

    You can require a CAPTCHA after a certain number of failed password-based authentication attempts (using a username, phone number, or email) for a single account within a specified time frame. This helps prevent brute-force attacks, such as rainbow table attacks.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Brute-Force Protection Captcha card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Time range: The time frame for counting authentication failures. The default is 5 minutes.

      2. Authentication failure count: The number of allowed authentication failures before a CAPTCHA is required. If set to 0, a CAPTCHA is always required.

      3. Enable: Enables or disables the brute-force protection with CAPTCHA feature.

    Brute-force rate limiting

    You can limit the number of failed password-based authentication attempts (using a username, phone number, or email) for a single account within a specified time frame. This helps prevent automated attacks and brute-force methods like rainbow table attacks.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Brute-Force Frequency Limit card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Time range: The time frame for counting authentication attempts, for example, 5 minutes.

      2. Frequency count: The maximum number of authentication attempts allowed, for example, 2.

      3. Lock time range: The duration for which the account is locked, for example, 5 minutes.

      4. Enable: Enables or disables the brute-force protection with rate limiting feature.

    SMS/email CAPTCHA

    You can require a CAPTCHA for SMS and email verification code requests to ensure they originate from a human user. This prevents bots from abusing the messaging service and helps you avoid unnecessary costs.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > SMS/Email Anti-Brute-Force CAPTCHA card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Time range: The time frame for counting authentication attempts, for example, 5 minutes.

      2. Authentication failure count: The number of allowed failed authentication attempts. For example, if two consecutive authentication attempts fail within the specified time range, a CAPTCHA is required.

      3. Enable: Enables or disables the SMS/email protection with CAPTCHA feature.

    SMS/email rate limiting

    You can apply rate limiting to SMS and email verification code requests. This prevents bots from abusing the messaging service and helps you avoid unnecessary costs.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > SMS/Email Brute-Force Frequency Limit card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Time range: The time frame for counting authentication attempts, for example, 5 minutes.

      2. Frequency count: The maximum number of authentication attempts allowed, for example, 2.

      3. Lock time range: The duration for which the account is locked, for example, 5 minutes.

      4. Enable: Enables or disables the SMS/email protection with rate limiting feature.

    Logon SMS verification limit

    You can limit the number of verification attempts for an SMS or email code within a single logon flow. This reduces the risk of an account being locked due to repeated incorrect entries.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Brute-Force SMS Limit card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Verification count: The number of allowed verification attempts. For example, if set to 3, the current verification code becomes invalid after 3 failed attempts.

      2. Enable: Enables or disables the logon SMS verification limit feature.

    Authentication frequency limit

    You can limit the total number of authentication attempts (both successful and failed) for a single account within a specified time frame. This helps prevent abuse from automated scripts and improves account security.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Authentication Rate Limit card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Time range: The time frame for counting authentication attempts, for example, 5 minutes.

      2. Authentication frequency count: The maximum number of authentication attempts allowed, for example, 2.

      3. Lock time range: The duration for which the account is locked, for example, 5 minutes.

      4. Enable: Enables or disables the authentication frequency limit feature.

    Password controls

    Password history

    You can maintain a history of a user's previous passwords to prevent reuse of recent passwords during registration or password changes. You can configure the number of previous passwords to store.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Historical Passwords card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Password history: The number of unique recent passwords that a user cannot reuse. For example, a value of 5 means the new password cannot match any of the last 5 passwords.

      2. Enable: Enables or disables the password history feature.

    Periodic password change

    You can require users to change their password periodically by setting a password validity period. When a password expires, the user is forced to create a new one before accessing application resources. Enable this feature with caution.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Periodic Password Change card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Password validity period: The length of time a password is valid. You can choose 10, 30, 60, 180, or 360 days.

      2. Enable: Enables or disables the periodic password change feature.

    Password strength check

    You can define and enforce a password strength policy for your users. When enabled, users must create passwords that meet the specified requirements during registration and password changes.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Password Security Detection card, you can configure and enable or disable the feature.

    3. Parameter descriptions:

      1. Minimum length: The minimum number of characters required for a password.

      2. Password complexity: The following complexity options are available:

        • Must contain uppercase letters

        • Must contain lowercase letters

        • Must contain digits (0-9)

        • Must contain special characters (!@#$%&*~)

        • Cannot contain the username

        • Cannot contain the pinyin of the user's name

        • Cannot contain the phone number

        • Cannot contain the email prefix

      3. Enable: Enables or disables the password strength check feature.

    Weak password check

    You can enable a check against a dictionary of common weak passwords. When enabled, the system prompts users during registration or password changes and prevents them from setting a weak password.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Weak Password Detection card, you can enable or disable the check.

    Compromised password check

    IDaaS maintains a continuously updated list of passwords exposed in public data breaches. When enabled, the system prevents users from creating passwords that appear in this database during registration or password changes.

    Configure in the console

    Procedure

    1. Log on to the CIAM platform with an administrator account.

    2. On the Risk Management > Risk Governance > Hacked Password Detection card, you can enable or disable the check.