--- title: Creating/Editing Secure Access Policies slug: ps/help/en_us/nsa/22x/nsa-zta/ag/1008 docTags: createdAt: 2026-07-22T14:00:50.962Z --- - [Introduction](docId\:ndGVDPLKGsRFI6krD7rok) - [Viewing your Secure Access Policies](docId\:ndGVDPLKGsRFI6krD7rok) - [Creating a Secure Access Policy](docId\:ndGVDPLKGsRFI6krD7rok) - [Editing a Secure Access Policy](docId\:ndGVDPLKGsRFI6krD7rok) # Introduction A secure access policy defines how end-users can connect to *Ivanti Neurons for Zero Trust Access* (*nZTA*) to access applications. Each secure access policy is defined in terms of four dimensions: - **Gateways**: An *nZTA Gateway* (or *nZTA Gateway*s) through which Application access is controlled, and on which the secure access policy is deployed, see [Working with Gateways](docId\:odDr4Z3VrHMCgVhHAWv7j). - **Users**: The user methods, user policies, and user groups that are required on the *nZTA Gateway*, see [Working with User Authentication](docId\:NJOnS_n7fVj7YPwBgqwRy). - **Devices**: The device policy rules and device policies that define which end user devices can access applications, see [Creating Device Policies and Device Policy Rules](docId:_nvGswHhwlgHDsmRPBWyz). - **Applications**: The on-premise and cloud applications to which end users have access, see [Working with Applications and Application Groups](docId:-fjkZEZfchYx8uec5GMuk). When a secure policy is created on the *Controller*, it is downloaded automatically and applied to the *nZTA Gateway* referenced by the policy. *nZTA* has one built-in secure access policy, *Application discovery*. This policy, when enabled and configured, directs any request from an application that is not referenced by a policy to a *default Gateway*. See [Configuring a Default Gateway for Application Discovery](docId\:odDr4Z3VrHMCgVhHAWv7j). # Viewing your Secure Access Policies To see the list of secure access policies currently defined on the *Controller*: 1. Log into the *Controller* as a Tenant Admin, see [Logging in as a Tenant Administrator](docId\:qAQLPFWfOt_GYC0QQw64z). 2. From the *nZTA* menu, select the **Secure Access** icon, then select **Secure Access Policies**. :::Paragraph{indent="1"} The *Secure Access Policies* page appears. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/LJc9JTcAd3R65ygMhN0kW_secureaccesspolicies.png" position="flex-start" size="80" width="1282" height="694" initialPath="img/secure_access_policies.png" githubPath="img/secure_access_policies.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} Viewing the list of secure access policies ::: Each policy is shown with the following details: - **Statusindicator**: The current availability of the application. - **Applications/Application Groups**: The Application or Application Group this secure access policy is configured for. - **Gateways**: The *nZTA Gateway* or *nZTA Gateway* Group or *nZTA Gateway* Selector that controls access to the applications named in this secure access policy. - **Users**: The User Group for this secure access policy. - **Device Policies**: The device policy that applies to this secure access policy. - **Enabled**: Whether or not this secure access policy is enabled. :::hint{type="info" indent="1"} Select the application name to view the *Application* or *Application Groups* page. ::: An *application group* is identified by the arrow adjacent to the application name. Select the arrow to show the applications available in this group: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/hP6bCnNKyv6XEgZ7dnMeW_secureaccesspoliciesappgrp.png" position="flex-start" size="80" width="1413" height="290" initialPath="img/secure_access_policies_appgrp.png" githubPath="img/secure_access_policies_appgrp.png" showCaption="false"} :::Paragraph{indent="1"} The applications contained in an application group ::: The *Status* indicator uses one of the following color schemes to determine application health: - **Green**: The application (or application group) is reachable. - **Gray**: The *Controller* cannot determine the availability of the application (or application group). - **Red**: The application (or application group) is unreachable. Application health status is available only for URL or IP address-based applications. Application definitions using a URI that contain a wildcard-based FQDN are not monitored for this purpose and are shown with a *gray* status indicator to denote that the status cannot be determined. :::hint{type="info"} The built-in *Application Discovery* policy is not monitored for this purpose and uses a gray status indicator. ::: :::hint{type="info"} To view a chart showing the top non-reachable applications, see [All Applications](docId:9pR-GUBlUQ_Ko0B6yMLkA). ::: Through this page you can: - *Create* a new secure access policy, see [Creating a Secure Access Policy](docId\:ndGVDPLKGsRFI6krD7rok). - *Edit* an existing secure access policy, see [Editing a Secure Access Policy](docId\:ndGVDPLKGsRFI6krD7rok). - Use the *View Details* link in the message, which appears on successful creating/updating of policy, to view the newly created/updated policy in the list. - *Enable* or *disable* a secure access policy. Select the policies you want to enable/disable using the toggle button, then select the corresponding link at the top of the page. - *Delete* a secure access policy. Use the three dots adjacent to the policies you want to delete, then select **Delete**. - Perform *Search* for occurrences of named applications, application groups, gateways, gateway groups, device policies, user groups and enabled status (yes/no) for the policies listed on this page. - *Filter* the policies displayed on the page by application/application group, gateway, user, device policy, or status. When you select the *Filter* icon, a side panel dialog appears within which you can select specific criteria to filter the display to show only matching policies. Applied filters remain in place until you select **Clear All** from the side-panel, or until you leave the page. # Creating a Secure Access Policy A secure access policy defines how end users can connect to *nZTA* to access applications. To create a secure access policy: 1. Log into the *Controller* as a Tenant Admin, see [Logging in as a Tenant Administrator](docId\:qAQLPFWfOt_GYC0QQw64z). 2. From the *nZTA* menu, select **Secure Access > Secure Access Policies**. The **Secure Access Policies** page appears. This lists all current secure access policies. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/LJc9JTcAd3R65ygMhN0kW_secureaccesspolicies.png" alt="Viewing the Secure Access Policies page" position="flex-start" size="80" width="1282" height="694" initialPath="img/secure_access_policies.png" githubPath="img/secure_access_policies.png" showCaption="false"} Viewing the Secure Access Policies page 3. Click **Create**: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/euRZ9q7tVsvFN7oAQoGDE_addsecureaccesspoliciesstart.png" alt="Creating a new Secure Access Policy" position="flex-start" size="80" width="1087" height="814" initialPath="img/add_secure_access_policies_start.png" githubPath="img/add_secure_access_policies_start.png" showCaption="false"} Creating a new Secure Access Policy :::hint{type="info"} At any point during this process, you can reset the form data by selecting **Reset**. You can also view existing secure access policies in a pop-up dialog by selecting **View Secure Access Policies**. ::: 4. Select the application, or application group, for the policy. Click **Next**. :::hint{type="info"} An application, or application group, can be associated with only one secure access policy. ::: 1. From the Device Policies list, select the device policy to apply to your Secure Access Policy. Click **Next**. 2. From the User Groups list, select the user group to apply to your Secure Access Policy. Click **Next**. 3. From the Gateways, Gateway Groups and Gateway Selectors list, select the nZTA Gateway/Gateway Group to which you want to publish your Secure Access Policy. Click **Next**. 4. Verify the Summary details and then click **Create**. The policy is created and added to the list of secure access policies. 5. (Optional) To edit a listed secure access policy, select the adjacent three dots and then select **Edit**. After the secure access policy is updated, it is automatically applied to the *nZTA Gateway* that it references. 6. (Optional) To enable a disabled secure access policy, use the toggle button. After the secure access policy is enabled, it is automatically applied to the *nZTA Gateway* that it references. 7. (Optional) To disable an enabled secure access policy, use the toggle button. 8. (Optional) To delete an *unused* secure access policy, select the adjacent three dots and then select **Delete**. Confirm the deletion in the subsequent dialog. After the secure access policy is created, it is automatically downloaded and applied to the *nZTA Gateway* that it references. :::hint{type="info" indent="1"} Secure Access Policies can take several minutes to reach their destination *nZTA Gateway*(s). If an entered policy contains configuration that fails to apply properly due to a compatibility or validation problem, *nZTA* displays an error message that the applied configuration is incorrect. *nZTA* attempts to re-apply the configuration in the policy at 15 minute intervals, and repeats this process until such a time as the policy is corrected or deleted. ::: # Editing a Secure Access Policy You can edit a secure access policy to change how end users connect to *nZTA* to access applications. For example, you must edit the *Application discovery* secure access policy if you want to use a default gateway to support the application discovery feature. To do this, you must assign an unused gateway to the secure access policy. See [Configuring a Default Gateway for Application Discovery](docId\:odDr4Z3VrHMCgVhHAWv7j) for details of default gateways. To edit a secure access policy: 1. Log into the *Controller* as a Tenant Admin, see [Logging in as a Tenant Administrator](docId\:qAQLPFWfOt_GYC0QQw64z). 2. From the *nZTA* menu, select the **Secure Access** icon, then select **Secure Access Policies**. The *Secure Access Policies* page appears. This lists all current secure access policies. 3. Select the three dots adjacent to the secure access policy you want to edit, then select **Edit**. The **Edit Secure Access Policy** form appears. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/Tby1SSrGOmRqE2-lYRO_x_editsecureaccesspolicies.png" alt="Editing a Secure Access Policy" position="flex-start" size="80" width="1171" height="562" initialPath="img/edit_secure_access_policies.png" githubPath="img/edit_secure_access_policies.png" showCaption="false"} Editing a Secure Access Policy :::hint{type="info"} The **Application Type** and **Application** cannot be changed. ::: 4. Make any required changes to the secure access policy. 5. Select **Save**.