This article describes a scenario in which a newly created user performs their first authentication into the Okta Dashboard. The Global Session Policy and Authentication Policy do not require Multi-factor Authentication (MFA), and the user must authenticate only with a Password.
The Enrollment Policy has factors set to REQUIRED that the user must enroll in.

 
When the user authenticates with a password in the Okta Dashboard, they will be prompted for MFA even though the Global Session Policy and the Authentication Policy do not require a second factor.

• Okta Identity Engine (OIE)
• Multi-factor Authentication (MFA)
• Enrollment Policies

This behavior is by design, as when enrolling an authenticator, a second factor needs to be provided for user verification.

This scenario applies mostly to admins who want to create an Enrollment Policy for service accounts. 

If this behavior is not desired, set up an Enrollment Policy where factors are set to OPTIONAL.