Okta Configurable Lockout Settings for Multi-Factor Authentication Failure Attempts
Last Updated:
Overview
Okta does not provide a configurable setting in the Admin Console to define the number of allowed Multi-Factor Authentication (MFA) failure attempts before a lockout occurs. In Okta Identity Engine (OIE), Okta automatically locks an authenticator for five minutes after five consecutive incorrect MFA codes and generates the following error:
Too many attempts. Try again later.
NOTE: In OIE, this lockout does not apply to SMS, Voice, or Email authenticators. With these authenticators, the user can re-select the authenticator to generate a new code.
In Okta Classic Engine, Okta automatically locks the user account after five consecutive incorrect MFA codes for all authenticators and generates the following error:
Your account is locked because of too many authentication attempts.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Multi-Factor Authentication (MFA)
Solution
How does Okta handle lockout settings for MFA failure attempts?
Okta does not provide a configurable setting in the Admin Console to define the number of allowed MFA failure attempts before a lockout occurs.
