[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Authentication > Managing MFA > Managing exceptions to MFA policies

# Managing exceptions to MFA policies

Exceptions prevent an [MFA policy](../../concepts/mfa.md#mfa-policies) from applying to individual users or [user groups](../../concepts/groups.md) added to the policy's target group. For example, you can exclude robots or an admin group if the policy is assigned to the entire organization. If you later remove these users or groups from the list of exceptions, they will not need to reconfigure authentication.

## Updating a list of exceptions {#update}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shield](../../../_assets/console-icons/shield.svg) **Security settings**.
  1. Navigate to the **MFA policies** tab and select the policy you need from the list. In the window that opens:

      1. Navigate to the **Exclusions** tab.
      1. To add a user or user group to the list of exceptions:

          1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add exclusion**.
          1. In the window that opens, select the required user or user group.
          1. Click **Add**.
      1. To delete a user or group from the list of exceptions:
          1. In the list of users and groups, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete** next to the user or user group.
          1. Confirm the deletion.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View a list of users or groups subject to the MFA policy:

     ```bash
     yc organization-manager mfa-enforcement list-audience \
       --id <policy_ID>
     ```

  1. View the description of the CLI command for updating a list of exceptions to an MFA policy:

     ```bash
     yc organization-manager mfa-enforcement update-excluded-audience --help
     ```

  1. To add a user or user group to a list of MFA policy exceptions, run this command:

     ```bash
     yc organization-manager mfa-enforcement update-excluded-audience \
       --id <policy_ID> \
       --audience-delta subject-id=<subject_ID>,action=<action>
     ```

     Where:

     * `--audience-delta`: Parameter to edit the list of users/groups in the policy:
       * `subject-id`: User or group ID.
       * `action`: Action, `action-add` to add, `action-remove` to delete.

     You can specify multiple `--audience-delta` parameters to add or remove more than one object at a time.

     Result:

      ```text
      mfa_enforcement_id: bpfjv8qeq4ii********
      effective_deltas:
        - action: ACTION_ADD
          subject_id: aje0j5mts02t********
      ```

- API {#api}

  Use the [UpdateExcludedAudience](../../api-ref/MfaEnforcement/updateExcludedAudience.md) REST API method for the [MfaEnforcement](../../api-ref/MfaEnforcement/index.md) resource or the [MfaEnforcementService/UpdateExcludedAudience](../../api-ref/grpc/MfaEnforcement/updateExcludedAudience.md) gRPC API call.

{% endlist %}

## Viewing a list of exceptions {#list}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shield](../../../_assets/console-icons/shield.svg) **Security settings**.
  1. Navigate to the **MFA policies** tab and select the policy you need from the list.
  1. In the window that opens, navigate to the **Exclusions** tab and view the list of users and groups excluded from the policy.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View a list of users or groups subject to the MFA policy:

     ```bash
     yc organization-manager mfa-enforcement list-excluded-audience \
       --id <policy_ID>
     ```

     Result:

      ```text
      +----------------------+---------------+
      |          ID          |     TYPE      |
      +----------------------+---------------+
      | aje0j5mts02t******** | federatedUser |
      +----------------------+---------------+
      ```

- API {#api}

  Use the [ListExcludedAudience](../../api-ref/MfaEnforcement/listExcludedAudience.md) REST API method for the [MfaEnforcement](../../api-ref/MfaEnforcement/index.md) resource or the [MfaEnforcementService/ListExcludedAudience](../../api-ref/grpc/MfaEnforcement/listExcludedAudience.md) gRPC API call.

{% endlist %}

#### See also {#see-also}

* [Applying an MFA policy to users](add-users.md)
* [Creating an MFA policy](create-policy.md)
* [Updating an MFA policy](update-policy.md)
* [Activating or deactivating an MFA policy](deactivate-reactivate-policy.md)
* [Deleting an MFA policy](delete-policy.md)
* [Removing an MFA factor and resetting the verification date](manage-verification.md)
* [Multi-factor authentication in Yandex Identity Hub](../../concepts/mfa.md)