Organization Adaptive Policy Configuration

Dashboard Location: Organization > Adaptive Policy

Organization-Wide Adaptive Policy and Dynamic Security Management

Adaptive Policy configuration in Meraki organizations provides administrators with comprehensive dynamic security capabilities, enabling Security Group Tag (SGT) based network segmentation, policy-driven access control, contextual security enforcement, and automated security group assignment. This functionality supports zero-trust network architectures, micro-segmentation strategies, identity-based access control, threat containment, and dynamic policy enforcement based on user identity, device type, location, and behavioral analysis. Adaptive Policy is essential for advanced network security, regulatory compliance, data protection, insider threat mitigation, and maintaining granular security controls across distributed enterprise networks while supporting software-defined perimeter concepts and continuous security assessment.

Diagram

Classes

organizations (meraki.domains)

Name	Type	Constraint	Mandatory	Default Value
adaptive_policy	Class	`[adaptive_policy]`	No

adaptive_policy (meraki.domains.organizations)

Name	Type	Constraint	Mandatory
name	String	min: `1`, max: `127`	No
settings_enabled_networks	List	String[min: `1`, max: `127`]	No
acls	List	`[acls]`	No
groups	List	`[groups]`	No
policies	List	`[policies]`	No

acls (meraki.domains.organizations.adaptive_policy)

Name	Type	Constraint	Mandatory
name	String	min: `1`, max: `127`	No
description	String	min: `1`, max: `1024`	No
rules	List	`[rules]`	No
ip_version	Choice	`any`, `ipv4`, `ipv6`	No

groups (meraki.domains.organizations.adaptive_policy)

Name	Type	Constraint	Mandatory
name	String	min: `1`, max: `127`	No
sgt	Integer	min: `0`, max: `65535`	No
description	String	min: `1`, max: `1024`	No
policy_objects	List	String[min: `1`, max: `127`]	No

policies (meraki.domains.organizations.adaptive_policy)

Name	Type	Constraint	Mandatory
source_group	Class	`[source_group]`	No
destination_group	Class	`[destination_group]`	No
acls	List	String[min: `1`, max: `127`]	No
last_entry_rule	Choice	`allow`, `default`, `deny`	No
organization_name	String	min: `1`, max: `127`	Yes
name	String	min: `1`, max: `127`	Yes

rules (meraki.domains.organizations.adaptive_policy.acls)

Name	Type	Constraint	Mandatory	Default Value
policy	Choice	`allow`, `deny`	Yes
protocol	Choice	`any`, `icmp`, `tcp`, `udp`	Yes
log	Boolean	`true`, `false`	No
tcp_established	Boolean	`true`, `false`	No
source_port	Any	Integer[min: `0`, max: `65535`] or String[matches: `(?:[1-9][0-9]3	[1-5][0-9]4	6[0-4][0-9]3
destination_port	Any	Integer[min: `0`, max: `65535`] or String[matches: `(?:[1-9][0-9]3	[1-5][0-9]4	6[0-4][0-9]3

source_group (meraki.domains.organizations.adaptive_policy.policies)

Name	Type	Constraint	Mandatory	Default Value
name	String	min: `1`, max: `127`	Yes
sgt	Integer	min: `0`, max: `65535`	No

destination_group (meraki.domains.organizations.adaptive_policy.policies)

Name	Type	Constraint	Mandatory	Default Value
name	String	min: `1`, max: `127`	Yes
sgt	Integer	min: `0`, max: `65535`	No

Examples

Example-1: The example below demonstrates organization adaptive policy configuration using tested YAML configuration from pipeline fixtures.

meraki:
  domains:
    - name: "!env domain"
      administrator:
        name: "!env org_admin"
      organizations:
        - name: "!env org"
          adaptive_policy:
            settings:
              enabled_networks:
                - "!env network_name"
            policies:
              - name: Corp Policy
                organization_name: "!env org"
                source_group:
                  name: USERS
                  sgt: 30
                  name: "CORPORATE_USERS"
                  sgt: 10
                destination_group:
                  name: "GUEST_USERS"
                  sgt: 20
                acls:
                  - name: "PERMIT_CORPORATE"
                description: "Internet access only for guests"
                rules:
                  - policy: allow
                    protocol: tcp
                    source_port: "any"
                    destination_port: "80,443"
                  - policy: deny
                    protocol: any
                    source_port: "any"
                    destination_port: "any"
                ip_version: ipv4
              # IoT device communication
              - name: "IOT_DEVICE_ACCESS"
                description: "Limited IoT device communication"
                rules:
                  - policy: allow
                    protocol: tcp
                    source_port: "any"
                    destination_port: "443,8883"
                  - policy: allow
                    protocol: udp
                    source_port: "any"
                    destination_port: "53,123,1883"
                ip_version: ipv4
              # Critical system protection
              - name: "CRITICAL_SYSTEM_PROTECTION"
                description: "Protect critical infrastructure"
                rules:
                  - policy: deny
                    protocol: any
                    source_port: "any"
                    destination_port: "any"
                ip_version: ipv4
            policies:
              # Executive to corporate communication
              - name: "Executive to Corporate Policy"
                source_group:
                  name: "EXECUTIVE_USERS"
                  sgt: 5
                destination_group:
                  name: "CORPORATE_USERS"
                  sgt: 10
                acls:
                  - name: "EXECUTIVE_FULL_ACCESS"
              # Corporate to IoT access
              - name: "Corporate to IoT Policy"
                source_group:
                  name: "CORPORATE_USERS"
                  sgt: 10
                destination_group:
                  name: "IOT_DEVICES"
                  sgt: 30
                acls:
                  - name: "CORPORATE_STANDARD_ACCESS"
              # Contractor access restrictions
              - name: "Contractor Access Policy"
                source_group:
                  name: "CONTRACTOR_USERS"
                  sgt: 15
                destination_group:
                  name: "CORPORATE_USERS"
                  sgt: 10
                acls:
                  - name: "CONTRACTOR_LIMITED_ACCESS"
              # Guest isolation policy
              - name: "Guest Isolation Policy"
                source_group:
                  name: "GUEST_USERS"
                  sgt: 20
                destination_group:
                  name: "CORPORATE_USERS"
                  sgt: 10
                acls:
                  - name: "GUEST_INTERNET_ONLY"
              # Critical infrastructure protection
              - name: "Critical Infrastructure Protection"
                source_group:
                  name: "GUEST_USERS"
                  sgt: 20
                destination_group:
                  name: "CRITICAL_INFRASTRUCTURE"
                  sgt: 40
                acls:
                  - name: "CRITICAL_SYSTEM_PROTECTION"