Okta Enrollment Flow Behavior With Security Question Enabled and Disabled

Enrollment flow behavior changes based on whether the Security question for self-service recovery option is enabled or disabled in the password policy. Different group assignments before or after initial sign-in determine whether the user must set up a security question during enrollment and whether self-service recovery requires it. After assigning the user to the intended policy group, the enrollment flow matches that policy's security question setting.

• Okta Classic Engine
• Okta Identity Engine (OIE)
• Enrollment Flow
• Security Question
• Password Policy
• Self-Service Recovery

An Early Access feature allows the Security question for self-service recovery option to remain disabled for self-service recovery. That feature creates different enrollment and recovery behavior based on which password policy applies when the user signs in for the first time and whether the administrator changes the user's group assignment after enrollment.

How does enrollment behave when a No Security Question Policy applies before the first sign-in?

Review the No Security Question Policy scenario to confirm an enrollment flow that does not require a security question.

• No Security Question Policy
  • Groups: No Security Question Group
  • Priority: 1
  • Security question for self-service recovery is disabled.

1. An administrator creates a user.
2. Before the user completes enrollment, place the user in the No Security Question Group. This action can occur on the account creation screen or before the user signs in for the first time.
3. Have the user sign in for the first time.

Result: The user is not prompted to set up a security question, and any self-service recovery attempt does not require one.

How does enrollment behave when a Security Question Policy requires a security question during enrollment?

Review the Security Question Policy scenario to confirm an enrollment flow that requires a security question.

• Security Question Policy
  • Groups: Security Question Group
  • Priority: 2
  • Security question for self-service recovery is enabled.

1. An administrator creates a user.
2. Before the user completes enrollment, place the user in the Security Question Group.
3. Have the user sign in for the first time.

Result: The user is prompted to set up a security question, and any self-service recovery attempt requires one.

How does enrollment behave after the user is moved to a No Security Question Group after the first sign-in?

Review the Default Policy and post-enrollment group change scenario to confirm when enrollment still prompts for a security question.

• Default Policy
  • Groups: Everyone
  • Priority: 3
  • Security question for self-service recovery is enabled.

1. An administrator creates a user.
2. Place the user in the Security Question Group or any group that evaluates against the Default Policy.
3. Have the user sign in for the first time and set up a security question.
4. Move the user to the No Security Question Group.

Result: The user is prompted to set up the security question during initial enrollment, but any subsequent self-service recovery attempt does not require it.

NOTE: If the option to disable the security question is not available, open a support request to have the feature enabled. Reference this article in the request.