Okta Factor Sequencing and User Enumeration Prevention for High Risk Logins
May 28, 2025
Single Sign-On
Okta Classic Engine
Okta Identity Engine
Overview
This article will explain how "User Enumeration Prevention" affects the authentication flow under Okta Factor Sequencing Policies during high-risk logins.
Applies To
- Sign-on policies with Factor Sequencing
- Sign in as high-risk
- Multi-factor Authentication (MFA)
Cause
"User Enumeration Prevention" is designed to secure the account and prevent exposure of user accounts and authenticator enrollments.
Solution
The flow will remain unchanged for Okta Policies assigned to low-risk authentications. However, for policies designated for high-risk logins, "User Enumeration Prevention" will prompt for a random factor to prevent potential attackers from discovering user authenticator enrollments. "User Enumeration Prevention" must be disabled to maintain the desired flow with normal factor sequencing instead of random sequencing.
