This article discusses why users are not prompted for app-level MFA immediately after logging into Okta.

• Multi-Factor Authentication (MFA)
• Org-level Authentication
• App-level Authentication
• Okta Classic Engine

When MFA is enabled and enforced at an Org-level sign-on policy and an Application-level sign-on policy, there is a small time window after logging into Okta. Users can launch an application with a sign-on policy (with MFA enforced at every sign-on), but is not prompted for a factor, even though the prompt is expected. If multi-factor authentication is enabled at both the Org level and App level, the user is not prompted for repeated multi-factor authentication. If the time between logging into Okta (and authenticating using multi-factor) and then immediately logging into the Application (that also requires multi-factor authentication) is less than 10 seconds.