Factors That Can Initiate Self-Service Password Reset in Okta Identity Engine

In Okta Identity Engine (OIE), the self-service password reset flow supports multiple authenticator options governed either by the Okta Account Management Policy or by legacy self-service password reset rules. The applicable policy is selected in the Recovery authenticators section of the self-service password reset configuration.

• Self-Service Password Reset
• Okta Identity Engine (OIE)

How Are the Factors Available to Perform a Self-Service Password Reset Configured?

Okta Identity Engine (OIE) manages password reset access through two distinct frameworks: the Okta Account Management Policy, which supports any configured authenticator in the org but may restrict certain methods depending on policy configuration, and the legacy self-service password reset rules, which support a fixed set of factors.

Factors Available Under the Okta Account Management Policy

Any configured authenticators can be selected in the Okta Account Management Policy. Adding policy constraints, such as requiring a phishing resistant or hardware protected factor, will automatically exclude some factors from meeting the policy requirements.

See Okta account management policy for more information on configuring these options.

Factors Available Under the Legacy Self-Service Password Reset Policy

Legacy self-service password reset policies support the following factors for initiating the password reset flow:

1. SMS (text message): A one-time code is sent to the phone number associated with the Okta account to reset the password.
2. Voice Call: Users who have forgotten their password receive a voice call with an audible password reset code.
3. Email: Users who have forgotten their password receive an email with a password reset code.
4. Okta Verify Push: A push notification is sent to end users who forgot their password.
5. Google Authenticator: End users enter their time-based one-time password (TOTP) to initiate the password recovery flow.

The additional verification step can be set to one of the following options:

• Not Required: After the user initiates the recovery flow and verifies their identity with one of the above factors, no additional factors are required and the user is allowed to reset their password.
• Any enrolled authenticator used for MFA/SSO: End users are prompted for any other enrolled factor after initiating the password recovery flow, and then the user is allowed to reset their password.
• Only Security Question: The user is prompted for their security question after initiating the flow, and then the user is allowed to reset their password.

How Is the Password Reset Framework Switched Between the Okta Account Management Policy and Legacy Rules?

Navigate to Security > Authenticators and complete the following steps to switch between the Okta Account Management Policy and the legacy self-service password reset and account unlock methods:

1. In the Password row, click Actions > Edit.
2. Click the pencil icon beside the rule to edit.
3. In the Access control section, select Authentication policy or Legacy (the currently active option is already selected).
4. If switching to the Legacy option, indicate what the authenticator is used for.