- Okta Identity Engine (OIE)
- Multi-Factor Authentication (MFA)
To enable this feature, go to the Admin Dashboard > click on Settings > select Features > choose Require phishing-resistant authenticator to enroll additional authenticators.
When enrollment policy restrictions prevent a user from enrolling in two authenticators that meet the assurance requirements, they will be unable to add more authenticators until they satisfy the necessary policy requirements. If this happens, the user may encounter an error message indicating that additional authentication methods cannot be added.
If a user is not registered with a phishing-resistant authenticator and the Require phishing-resistant authenticator to enroll additional authenticators feature is turned on for their organization, the user can still add more authenticators by using their current authenticators to verify their identity.
If a user does not already have a phishing-resistant authenticator enrolled and this feature is turned on, they will still be able to enroll in additional authenticators. However, they will need to enroll in two authenticators that meet the assurance requirements.
Another possible solution to the issue is to ensure that the time on the user's device is correct and that the time difference is not greater than one minute. This is based on findings from Okta's backend logs, which showed that the Issue time on request is greater than the current time on the server.
