Exceptions are used as access deny lists in Access Control. Exceptions are created automatically when you block the user during a manual or automatic disconnect session.
Navigate to Access Control > Exceptions and click the Configuration icon on the right pane to set properties or exceptions.
Status: You can retain the enabled status of this option if you want the exceptions to be evaluated while processing the privileged access requests by Access Control. This option is enabled by default. Move the slider to the left if you want to disable this option.
Deny Access On: You can select any combination of Resources or Permissions.
Selection All Resources implies that user access is denied on all resources.
Selecting Target Resource implies that user access is denied on the target resources only.
Selecting All Permissions implies that user access is denied for all permissions.
Selecting Target Permission implies that user access using the target permission is denied for the user with any permission.
Following are all the possible combinations:
All Resources + All Permissions: This combination implies that all access for the user is denied.
All Resources + Target Permission: This combination implies that user access for the target permission is denied on all resources. Example: If the target permission is Direct RDP, then user access to any resource using Direct RDP is denied.
Target Resource + All Permission: This combination implies that access to the target resource is denied for the user using any permission.
Target Resource + Target Permission: This combination implies that user access using target permission to the target resource is denied.
Expire After: You can set the validity for the exception in minutes, hours, days, week, or never. The default value Never, implies the exception will be applicable indefinitely.
Delete After: You can set the deletion time for the exception after expiry. The exceptions will be purged from the server after the configured days of expiry. Only the expired exceptions will be deleted.