How does ForgeRock AM support Adaptive Authentication?

Adaptive authentication (also called risk-based authentication) in ForgeRock AM is the practice of adjusting the authentication challenge based on real-time contextual risk signals. Instead of requiring every user to pass a fixed MFA challenge, AM evaluates risk factors and demands a stronger proof of identity only when the risk profile warrants it. This balances security with user experience — low-risk logins get a frictionless single-factor experience; high-risk logins are challenged with MFA.

Risk signals that AM can evaluate natively include:

• Device Fingerprint — Collects browser characteristics (user agent, screen resolution, timezone, plugins) and compares against a stored fingerprint for that user. A new or unrecognised device triggers a challenge.
• IP Address / Geolocation — AM can check the originating IP against a blocklist, whitelist, or GeoIP database. Logins from unexpected countries or IP ranges increase the risk score.
• Previous Session Data — Comparing current login time/location against historical patterns.
• Authentication Level — The tree can check whether the current session already has a sufficient auth level before demanding re-authentication.
• Scripted Risk Scores — Custom Scripted Decision Nodes can call external fraud/risk APIs (such as ForgeRock Intelligent Access, ThreatMetrix, or in-house systems) and route based on the returned score.

A typical adaptive tree flow:

1. Collect username and password → Data Store Decision node.
2. Collect device fingerprint → compare against stored fingerprint.
3. If fingerprint matches → check IP reputation via scripted node.
4. If IP is clean and fingerprint matches → grant access (single factor).
5. If device is new or IP is suspicious → route to TOTP or Push MFA node.
6. If high risk (blocked IP, impossible travel) → deny or require additional verification.