When using Okta as a third-party identity provider for Google Workspace, Google prompts users previously enrolled in Google 2-Step Verification for Multi-Factor Authentication (MFA) even though the organizational unit (OU) has 2-Step Verification enforcement disabled.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Google Workspace
• Multi-Factor Authentication (MFA)
• Single Sign-On (SSO)

A configuration on the Google Workspace side regarding post-SSO verification causes this issue for users that have previously been enrolled in Google 2-Step Verification.

How is the Google Workspace multifactor authentication prompt resolved?

Navigate to the login challenges section in the Google Admin console, select the organizational unit, and configure the post-SSO verification settings to prevent unexpected multifactor authentication prompts.

1. In the Google Admin console, navigate to Menu > Security > Authentication > Login challenges.
   NOTE: This action requires the User security management administrator privilege.
2. Select the organizational unit to apply the policy to from the left pane. Select the top-level organizational unit to apply the policy to all users. Initially, organizational units inherit the settings of the parent.
3. Click Post-SSO verification.
4. Select Don’t ask users for additional verifications from Google under Settings for users signing in using the legacy SSO profile and Settings for users signing in using other SSO profiles.

5. Click Save on the bottom right.

NOTE: This is a Google Workspace configuration. Contact Google Support for any further questions regarding this configuration.

Related References

• Enable login challenges with SSO