Desktop MFA Login Failed After Enabling Optional User Account Field

Profile Update causes Desktop MFA to throw the following error: 

Login Failed
 

• Okta Identity Engine (OIE)
• Desktop MFA
• Profile Enrollment

After enabling the Optional User Account Field under Customizations > Secondary Email, the end users will be prompted for a secondary email address as an option to fill in. This response is sent by the API after authenticating, which is the profile-update. This response can also be caused by a profile enrollment policy requesting a user for an attribute.

When the user authenticates through Desktop MFA, the Okta Device Access client sends an API request to the tenant, expecting either select-authenticator-authenticate or select-authenticator-enroll as a response. 

When the Optional User Account Field is enabled or when an enrollment policy requests a user to fill in an attribute, the Device Access client receives profile-update as a response from the API instead of "select-authenticator-authenticate" or select-authenticator-enroll. The profile-update option is not a recognized response by the Device Access client, which will trigger an error that will be thrown by the Device Access Service.

This error can be checked under the Okta Device Access logs; the error message will show Login Failed, but the event proceeding the error will include the following:

Unexpected remediation step: Expected '['select-authenticator-authenticate or select-authenticator-enroll']' but received ['profile-update,skip'].
          Verify that your policies are configured as expected.

1. Navigate under Customizations > Optional User Account Field and disable Secondary Email. 
2. Make sure that there is no profile enrollment policy that will prompt any Desktop MFA user for a field to update their profile.