Devices Remain in Okta Admin Console After Resetting Factors via API
Last Updated:
Overview
When resetting user factors using the reset_factors API endpoint, Okta successfully removes the authenticators, but the registered devices remain visible in the Okta Admin Console > Device tab. This occurs because the reset_factors endpoint is a legacy Okta Classic Engine API that does not remove the device-user association in Okta Identity Engine (OIE). Resolve this issue by using the authenticatorEnrollments API endpoint to delete the specific authenticator enrollment and sever the device connection.
Applies To
- Okta Identity Engine (OIE)
- Okta API
Cause
The POST /api/v1/users/<userId>/lifecycle/reset_factors endpoint originates from Okta Classic Engine. When executed in an OIE environment, the endpoint clears the factor enrollment data but fails to remove the underlying device-user association. Consequently, the device remains visible in the Okta Admin Console.
Solution
How are devices and factors completely removed in Okta Identity Engine?
Review the differences between the legacy and modern API endpoints, and use the recommended Okta Identity Engine authenticator enrollments endpoint to successfully remove the authenticator and sever the device association.
Legacy Endpoint
POST /api/v1/users/{userId}/lifecycle/reset_factors- Engine: Okta Classic Engine
- Device Association: Does not remove the device connection.
Avoid using the POST /api/v1/users/<userId>/lifecycle/reset_factors endpoint in OIE. While it wipes every Multi-Factor Authentication (MFA) enrollment, such as SMS, Time-based One-Time Password (TOTP), WebAuthn, and push, and transitions the user to an ACTIVE state if they lock out due to MFA failures, it leaves the device connection intact.
Modern Endpoint
DELETE /api/v1/users/{userId}/authenticatorEnrollments/{enrollmentId}- Engine: Okta Identity Engine
- Device Association: Completely removes the device-user connection.
Use the DELETE /api/v1/users/<userId>/authenticatorEnrollments/<enrollmentId> endpoint instead. This endpoint surgically unenrolls one specific factor and completely removes the device connection. The user must re-enroll that specific authenticator afterward.
