Disable the Email Verification Screen for Locked Okta Accounts

The User Enumeration Prevention (UEP) feature masks account lockout statuses and presents an email Multi-Factor Authentication (MFA) option instead of a lockout message. Disabling the UEP feature allows Okta to display an explicit lockout message. Users experience this issue when an Okta account reaches the lockout threshold, and Okta presents the email MFA option instead of a lockout message.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Password Reset
• User Enumeration Prevention (UEP)

The User Enumeration Prevention (UEP) feature causes this behavior. When UEP is active, Okta intentionally masks the actual status of an account by presenting a standard verification prompt, like email MFA. This security mechanism prevents malicious actors from performing username enumeration attacks.

How does an administrator disable the email verification screen for locked Okta accounts?

Navigate to the Security settings in the Okta Admin Console and disable the User Enumeration Prevention feature to stop the email verification screen from appearing and display a clear lockout message.

1. Sign in to the Okta Admin Console.
2. Go to Security > General.
3. Locate the User Enumeration Prevention section.

4. Select Edit and disable the feature.
5. Select Save.

NOTE: Disabling User Enumeration Prevention (UEP) reduces organizational protection against username enumeration attacks. Review organizational security policies and ensure that exposing account statuses aligns with current risk tolerance and compliance requirements before making this change.