Configure the password authenticator after app branding migration

After you upgrade using app branding migration, review and configure the password authenticator to ensure that it works correctly and meet your org's security and recovery requirements.

About this task

  • The password authenticator behaves differently in Identity Engine than in Classic Engine. See Password reset and account recovery.
  • The password policy is evaluated together with the authentication enrollment policy.
  • Identity Engine introduces the Okta account management policy. When you upgrade to Identity Engine, the recovery rule for the password authenticator includes a legacy rule option that maintains Classic Engine behavior. However, Okta recommends configuring the Okta account management policy option to take advantage of Identity Engine features. See Okta account management policy.

Procedure

  1. In the Admin Console, go to Security > Authenticators.
  2. Click Actions > Edit for the Password authenticator.
  3. Click the pencil icon for Recovery rule.
  4. Review the Access control section. The legacy rule is preselected to maintain similar behavior to Classic Engine, but Okta recommends that you select the Authentication policy option to take advantage of Identity Engine features.
  5. Review and update other settings as needed, and click Update rule.
  6. To review and edit other password authenticator settings, see Configure the password authenticator.

What to do next

Review information about the phone and SMS authenticators:
  • The phone authenticator behaves differently in Identity Engine than in Classic Engine. See Phone authenticator.
  • In Identity Engine, Phone and SMS are merged into a single authenticator. In Classic Engine, Phone and SMS are two different authenticators. If your end users are enrolled in Phone or SMS, when you upgrade to Identity Engine, they're enrolled automatically in both authenticators.