This article explains why a user's account remains active, even when the following error is received:
This factor is suspended for your account due to too many failed attempts.
This behavior occurs when login attempts are marked as invalid credentials in the system log.
- Okta Classic Engine
- User Account
- Multi-Factor Authentication (MFA)
This is expected behavior in this situation. There is no way to avoid this in Okta Classic because the password is not an MFA factor (only Okta Identity Engine).
If the password factor attempt fails, both counters increment. The Multi-Factor Authentication (MFA)/one-time passcode (OTP) counter increments because a factor attempt failed. The factor suspends counter increments because the password factor attempt failed. This makes for an inconsistent experience. If the factor’s account-lock threshold is lower than 5 (MFA/OTP threshold), the factor is suspended before the account can lock. However, if the threshold is higher than 5, the account locks before the factor can be suspended.
NOTE: The password shim also locks the account when it suspends the factor. The account always locks, but if it locks due to the old MFA/OTP count, the factor does not suspend.
