This article clarifies Okta's data retention period for user behavior profiles.

 

• Behavior detection
• Data retention

Okta maintains behavior profile data for a rolling 90-day period. This retention schedule is a standard internal policy for application-generated system data. After 90 days, historical behavior data is automatically purged from the system.

The 90-day retention period for behavior profiles has a direct impact on authentication policy evaluation. If an authentication policy is configured to evaluate a user's IP address, location, or device, any previously seen behavior that is more than 90 days old will be treated by Okta as a new, unrecognized behavior. Depending on the specific policy rules, this may trigger additional security challenges, such as a Multi-Factor Authentication (MFA) prompt for the end user.