Okta Authentication Policies Do Not Apply to Google Super Admins on Mobile Devices
Last Updated:
Overview
Google Super Admin privileges allow certain mobile sign-in flows to bypass Okta authentication policies. The behavior occurs because Google permits Super Admin accounts to skip third-party Single Sign-On (SSO) and Multi-Factor Authentication (MFA) prompts in specific scenarios, and no Okta-side change can resolve it.
The issue occurs when a user adds a Google account directly to a mobile application, and services such as mail and contacts sync without the expected authentication prompt, even when restrictive policies are in place.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Google Workspace
- Authentication Policies
- Mobile Devices
- Google Super Admin accounts
Cause
Google designates Super Admin accounts with special privileges. Those privileges allow Google to bypass third-party Single Sign-On (SSO) and Multi-Factor Authentication (MFA) prompts during certain authentication flows, such as adding an account directly on a mobile device.
Solution
How is the mobile authentication behavior addressed?
The following information confirms the product behavior and sets the expected outcome for affected accounts.
- Confirm that the affected account has Google Super Admin privileges.
- Verify that the sign-in flow starts by adding the Google account directly in the mobile application or in the device's account settings.
- Recognize that Google allows Super Admin accounts to bypass third-party Single Sign-On and Multi-Factor Authentication prompts in this scenario.
- Treat the behavior as expected behavior rather than an Okta authentication policy failure.
- Use a non-Super Admin account for testing when policy enforcement validation is required on mobile devices.
