Set required authenticators for MFA enrollment policies

Enabling at least one required authenticator for your org ensures that end users assigned to a given policy are enrolled in multifactor authentication (MFA).

Once a required authenticator is set, you can also update your sign-on policy to prompt users to enroll in the authenticator the next time they sign in.

HealthInsight task recommendation

Set require authenticators to ensure that end users assigned to a given policy are enrolled in authenticators.

Okta recommends

Require at least one authenticator in every MFA enrollment policy.
Security impact

Moderate
End-user impact

None

If an authenticator is required as part of the MFA enrollment policy, end users must enroll in the authenticator before they can sign in to their org. Setup varies depending on the authenticator specified.

Set a required authenticator in an MFA enrollment policy

  1. In the Admin Console, go to SecurityAuthenticators.

  2. Click the Enrollment tab.

  3. Select a policy and click Edit.
  4. From the list of Effective authenticators, set at least one authenticator to Required.
  5. Click Update Policy.

Set an enrollment policy rule that allows a user to enroll in an authenticator when prompted

  1. In the Admin Console, go to SecurityAuthenticators.
  2. Click the Enrollment tab.
  3. Choose one of the active policy rules in the list and click Edit.
  4. Under the condition THEN Enrollment is, select Allow if required authenticators are missing.
  5. Click Update Rule.

Set a sign-on policy rule that prompts for authenticators

  1. In the Admin Console, go to SecurityOkta Sign-on Policy.

  2. Select the policy to which you want to add rules.

  3. Select a rule and click Edit.

  4. In Then Access is: Based on the authentication form of the previous dropdown menu, use this one to establish whether the condition allows or denies access.
  5. In Prompt for Factor: Select Password / IDP or Password / IDP / any factor allowed by app sign on rules.
  6. Click Update Rule.

See Add a global session policy rule.

Related topics

HealthInsight tasks and recommendations

Network zones

Configure Okta ThreatInsight

Password changed notification for end users

Authenticator enrolled notification email for end users

Authenticator reset notifications for end users

General Security