[Документация Yandex Cloud](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Справочник CLI (англ.)](../index.md) > [authentication-policy-rule](index.md) > create

# yc organization-manager authentication-policy-rule create

Create an authentication policy rule

#### Command Usage

Syntax:

`yc organization-manager authentication-policy-rule create [NAME] [Flags...] [Global Flags...]`

#### Flags

#|
||Flag | Description ||
|| `--name` | `string`

Name of the authentication policy rule. ||
|| `--organization-id` | `string`

Set the ID of the organization to use. ||
|| `--description` | `string`

Description of the authentication policy rule. ||
|| `--effect` | `string`

Effect to apply when the rule matches. Values: 'allow-with-obligations', 'deny' ||
|| `--obligations` | `string`

Obligations as a JSON array. For example: [{"stepUpRequired":{"acrId":"acr-id","ttl":"300s"}},{"skipMfa":{"requireOnce":true}},{"reauthenticationRequired":{"ttl":"300s"}}]. Use [] to clear obligations. ||
|| `--subjects-include` | `[]string`

Subject IDs to include. An empty list matches all subjects. ||
|| `--subjects-exclude` | `[]string`

Subject IDs to exclude. ||
|| `--networks-include` | `[]string`

Source IP ranges in CIDR notation to include. An empty list matches any source. ||
|| `--networks-exclude` | `[]string`

Source IP ranges in CIDR notation to exclude. ||
|| `--applications-include` | `[]string`

Application IDs to include. An empty list matches all applications. ||
|| `--applications-exclude` | `[]string`

Application IDs to exclude. ||
|| `--labels` | `key=value[,key=value...]`

Labels as comma-separated KEY=VALUE pairs. ||
|| `--async` | Display information about the operation in progress, without waiting for the operation to complete. ||
|#

#### Global Flags

#|
||Flag | Description ||
|| `--profile` | `string`

Set the custom profile. ||
|| `--region` | `string`

Set the region. ||
|| `--cloud-id` | `string`

Set the ID of the cloud to use. ||
|| `--folder-id` | `string`

Set the ID of the folder to use. ||
|| `--folder-name` | `string`

Set the name of the folder to use (will be resolved to id). ||
|| `--debug` | Debug logging. ||
|| `--debug-grpc` | Debug gRPC logging. Very verbose, used for debugging connection problems. ||
|| `--no-user-output` | Disable printing user intended output to stderr. ||
|| `--pager` | `string`

Set the custom pager. ||
|| `--no-pager` | Do not pipe help output through a pager. ||
|| `--format` | `string`

Set the output format: text (default), yaml, json, json-rest. ||
|| `--retry` | `int`

Enable gRPC retries. By default, retries are enabled with maximum 5 attempts.
Pass 0 to disable retries. Pass any negative value for infinite retries.
Even infinite retries are capped with 2 minutes timeout. ||
|| `--timeout` | `string`

Set the timeout. ||
|| `--token` | `string`

Set the OAuth token to use. ||
|| `--jq` | `string`

Query to select values from the response using jq syntax ||
|| `--endpoint` | `string`

Set the Cloud API endpoint (host:port). ||
|| `--impersonate-service-account-id` | `string`

Set the ID of the service account to impersonate. ||
|| `--no-browser` | Disable opening browser for authentication. ||
|| `--query` | `string`

Query to select values from the response using jq syntax ||
|| `--print-metadata` | Print operation metadata along with result. ||
|| `--syntax` | `string`

Choose syntax option. ||
|| `--cli-auto-prompt` | `string[="on"]`

Enable interactive auto-prompt mode. Values: on, partial, off. Bare --cli-auto-prompt is equivalent to --cli-auto-prompt=on. ||
|| `--no-cli-auto-prompt` | Disable interactive auto-prompt mode (overrides --cli-auto-prompt, env and profile). ||
|| `-h`, `--help` | Display help for the command. ||
|#