This article explains some key differences between the Okta zone DefaultExemptIpZone, created with the IP except zone feature, and the ThreatInsight Exclude IP zones.
- IP zone
- Okta Classic Engine
The DefaultExemptIpZone zone is created by the IP exempt zone feature.
Okta will automatically allow traffic from the IPs added to this zone, and those IPs will not be evaluated by Okta ThreatInsight.
The ThreatInsight Exclude IP zones field accepts any Network Zone and prevents those IP addresses from being evaluated by ThreatInsight.
The DefaultExemptIpZone zone will automatically allowlist the IP addresses added to it without the zone needing to be added to the Okta ThreatInsight settings. Both the Exempt Zones and the DefaultExemptIpZone zone will prevent ThreatInsight from evaluating the listed IP addresses during log-in. Gateway IPs added to DefaultExemptIpZone always have access to Okta resources, offering a bypass to IP and ASN session binding based on the client IP.
For more information, please kindly refer to the following documents:
