Configuring Okta OTP-Based Passwordless Sign-In with User Enumeration Prevention
Last Updated:
Overview
User Enumeration Prevention (UEP) is a tenant-wide setting that deliberately shows every user the same sign-in options to prevent attackers from discovering which accounts exist. To configure One-Time Password (OTP) passwordless sign-in while preventing account enumeration, administrators must adjust org-wide authenticators or use magic links.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- User Enumeration Prevention (UEP)
- Passwordless Sign-In
Solution
Why does User Enumeration Prevention display unenrolled factors?
User Enumeration Prevention (UEP) is a tenant-wide setting that deliberately shows every user the same sign-in options, regardless of whether the account exists or the user has enrolled in a given factor. Okta displays email, password, or SMS options for users who do not have them, and group-based conditions do not change the screen. If Okta showed only the factors a specific user has, an attacker could learn which accounts exist and how administrators protect them. Okta cannot deliver OTP screens tailored by user or policy while simultaneously preventing account disclosure at this layer.
Configure passwordless sign-in options to remove unenrolled factors.
Remove authenticators or enable magic links to configure passwordless sign-in options.
- Remove email or password options from the org-wide authenticators to take them off the sign-in screen.
- Configure magic links to provide a passwordless experience.
NOTE: UEP does not take effect if the configuration allows self-service registration or email-based Just-In-Time (JIT) provisioning.
How does Okta mitigate automated traffic?
Stopping third parties from probing accounts through brute force is an automated traffic problem. Administrators can implement Identity Threat Protection (ITP) for Okta Customer Identity (OCI) to address automated traffic and brute-force attacks.
