When administrators configure an Okta password policy to automatically expire a password, the user account status remains Active until a login attempt occurs. Okta evaluates the password expiration policy against the password last changed date only during an active authentication attempt. Administrators observing that expired users still show an Active status must understand this default behavior and configure appropriate notifications.
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Password Policies
- Password Expiry
Why does the user account status remain Active after password expiration?
Okta designs the password expiration policy to check against the user's password last changed date. Okta waits for a login attempt before updating the account status based on the password expiration policy. This behavior represents a default Okta setting that administrators cannot modify.
Review the provided documentation to determine the password expiration date and understand when the policy starts.
How does password expiration work with Okta FastPass?
For passwordless authentication with Okta FastPass, Okta does not prompt users for a password reset. Okta evaluates the password only when a user logs in with a password. If the user authenticates exclusively with Okta FastPass, the password does not expire. Okta implements this behavior to prevent a disconnected authentication experience where users receive unexpected password reset prompts while using Okta FastPass. Administrators must set up an automation to notify users of the requirement to change passwords.
What are the additional considerations for password policies?
Review the following considerations to manage password expiration and maintain account security in an Okta organization.
- Password Policy Configuration: While the default behavior waits for a login attempt, administrators can configure the password policy to set other account statuses (for example, Locked) under specific conditions.
- User Communication: Organizations must inform users about password policies, including password expiration details and the grace period before an account status changes.
- Password Reset Options: Organizations must provide convenient options for resetting expired passwords, such as self-service password reset portals or administrative assistance.
NOTE: Administrators can effectively manage password expiration and maintain account security by understanding the default behavior and implementing appropriate password policies.
