Modify Email Factor Challenge Lifetime

The email authenticator is a possession factor and fulfills the requirements for user presence.

This article outlines how the default email challenge lifetime, or the length of time a user has to respond to an email prompting for MFA or Recovery.

• Multi-Factor Authentication (MFA)
• Factors
• Email authenticator

The default value is 5 minutes. The amount can be increased in 5-minute intervals up to 30 minutes. The best practice is 10 minutes or less. 

NOTE: The email is not always transmitted through secure protocols. Unauthorized third parties can intercept unencrypted messages. Assigning a shorter challenge lifetime can minimize this risk.
 

1. Okta Classic Engine
   • Go to the Security tab, click on Multifactor, and select Email Authentication. Modify the Email Authentication Settings by clicking the Edit button.

For more information about the Email factor on the Classic Engine, see Email Authentication (MFA).

2. Okta Identity Engine (OIE)

• Go to the Security tab and click on Authenticators. For the Email factor, click on Actions, then Edit. Here, modify the Email challenge lifetime (minutes) default value by clicking the dropdown and selecting the desired value.