• Multi-Factor Authentication (MFA)
• Factor Enrollment
• Okta Classic Engine

In order to restrict MFA Enrollment to only work in a specific zone, two rules have to be created: one to deny enrollment outside of that specific zone (higher priority) and another one to allow enrollment inside the specific zone (lower priority).

NOTE: Adding only one rule that will "allow" enrollment while inside a zone will not "deny" enrollment outside that zone.

The steps to create the enrollment policies to restrict enrollment inside a specific zone are:

1. Go to Security > Multi-Factor/Authenticators and add a new enrollment policy on top of the Default one.

2. Set up the first rule to allow enrollment in a specific zone.
    

3. Set up the second rule to deny enrollment outside of that specific zone.

4. Use the dotted line next to the Rule's number to drag the one that denies enrollment to have the higher priority.