Okta Identity Engine Self-Service Account Unlock Fails To Send Verification Email

When a user attempts the self-service unlock account flow in Okta Identity Engine, the widget transitions to the verification code screen, but Okta sends no email or SMS, and Okta records no events in the System Log. This occurs due to a mismatch between the authentication policy routing and the email authenticator configuration, or a missing email delivery configuration. Administrators must verify the authenticator settings, confirm the Okta Account Management Policy, and check the tenant email delivery configuration.

• Okta Identity Engine (OIE)
• Self-Service Account Unlock
• Email Authenticator

When administrators configure the password policy rule access control to route through the Okta Account Management Policy, the unlock flow uses the modern policy engine. If the Email authenticator retains a legacy configuration, Okta fails to send the verification email because the Account Management Policy lacks permission to invoke email delivery for that authenticator. Additionally, incomplete email delivery configurations or IP allowlist restrictions cause the email send request to fail silently without logging an event.

How do administrators verify the email authenticator configuration?

Navigate to the Authenticators page in the Admin Console to verify the email authenticator configuration and ensure Okta uses it for authentication and recovery.

1. Sign in to the Okta Admin Console.
2. Navigate to Security and select Authenticators.
3. Locate the Email authenticator in the list on the Setup tab.
4. Select Actions and choose Edit next to the authenticator.
5. Locate the This authenticator can be used for setting in the configuration window.
6. Ensure the configuration uses the Authentication and recovery option.
7. Review the Email challenge lifetime (minutes) to ensure the one-time passcode remains valid long enough for users to retrieve it.
8. Select Save to apply any changes.

Navigate to the Enrollment tab to verify the enrollment policy and guarantee that users can use the email authenticator once configured.

1. Select the Enrollment tab within Security, then Authenticators.
2. Select the active policy and review the rules.
3. Check the list of eligible authenticators to ensure the policy sets Email to either Allowed or Required.

The Okta Account Management Policy Requires Confirmation

Navigate to the Authentication Policies page to confirm the Okta Account Management Policy includes the email authenticator as a valid verification method.

1. Sign in to the Okta Admin Console.
2. Navigate to Security and select Authentication Policies.
3. Select the Okta Account Management policy.
4. Select the Rules tab to view the list of prioritized rules.
5. Select Actions and choose Edit to review the relevant rules tied to actions like Recover password or Enroll authenticators.
6. Examine the requirements in the Then Use this authentication to grant access or User must authenticate with section.
   • If the rule requires Any 1 factor type or Any 2 factor types, the Email authenticator is automatically valid as long as it remains active under the Authenticators page.
   • If the rule specifies a particular authentication method, Email can serve as the additional factor.
   • If the rule relies on Specific authenticators or an Authenticator Group, verify that the rule explicitly includes the Email authenticator.

NOTE: The Okta Account Management Policy dictates how a user proves identity to perform account actions. For the email authenticator to remain available during these flows, administrators must enable and assign it to the user in the Authenticator Enrollment Policy.

How do administrators check the tenant email delivery configuration?

Navigate to the Email provider page to check the tenant email delivery configuration and ensure Okta can send outbound emails.

1. Sign in to the Okta Admin Console.
2. Navigate to Customizations and select Email provider.
3. View the current SMTP or third-party email provider configuration.
4. Select Send test email under the SMTP server details to verify the configuration.
5. Enter a valid email address in the From field and a destination address in the To field.
6. Select Send test email.
7. Check the inbox of the destination address to confirm successful delivery.

NOTE: If using a custom email domain rather than a custom SMTP provider, administrators can check the status by navigating to Customizations, selecting Brands, choosing the brand, and navigating to the Email domain section to ensure the domain shows a verified status.

System Log Events Provide Delivery status

Search the System Log for email delivery events and test the flow with a different user to isolate the issue.

1. Navigate to Reports and select System Log.
2. Enter eventType eq "system.email.delivery" in the search field and filter by the date and time of the test.
3. Review the events for a FAILURE status and check the event details for the failure reason.
4. Create a test user with a valid email address, such as user@example.com, and attempt the unlock flow again.
5. Contact Okta Support if the System Log shows no email delivery events, and provide the tenant name, test user ID, exact timestamp of the unlock attempt, and confirmation of the previous steps.