Okta Global Session Policy Rule Limitations for Deny Access With Behavior or Risk Conditions
Last Updated:
Overview
Okta restricts Global Session Policy rules from denying access based solely on behavior or risk conditions. Administrators configuring a policy with AND Behavior is or AND Risk is alongside THEN Access set to Denied find that Okta does not enforce the denial. Okta denies access only if Multi-Factor Authentication (MFA) fails, preventing legitimate users from experiencing account lockouts.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Global Session Policy
Cause
An administrator configures a Global Session Policy rule with the conditions AND Behavior is or AND Risk is, and sets the action for THEN Access to Denied.
Solution
Why does Okta ignore the deny action for behavior or risk conditions?
Okta does not support using a Global Session Policy to deny access to users based on behavior or risk conditions. Okta only denies access if MFA fails. This limitation prevents legitimate users from experiencing account lockouts caused by false-positive risk or behavior evaluations.
