Okta User Enumeration Prevention Triggering in Known Devices for Active Directory Users

Okta User Enumeration Prevention (UEP) triggers on known devices for Active Directory (AD) sourced users when Okta does not recognize the login identifier in the User Profile Policy. To resolve this, users must log in with a known identifier, or administrators must configure the alternate identifier in the User Profile Policy. When this issue occurs, Okta prompts users for factors listed in UEP configuration rather than deferring to policy settings or other configurations, even on known devices. The System Log displays the following event:

Authenticate user via identifier not in User Profile Policy

• Okta Identity Engine (OIE)
• User Enumeration Prevention (UEP)
• Active Directory (AD) Sourced Users
• User Profile Policy

Okta does not recognize the login identifier because the User Profile Policy lacks the configuration for the alternate identifier. This triggers User Enumeration Prevention, causing Okta to prompt the user for the factors listed in UEP first instead of deferring to the policy, even when the device is known. The user successfully logs in due to Delegated Authentication, but the System Log records an Authenticate user via identifier not in User Profile Policy event.

How is the User Enumeration Prevention trigger resolved for Active Directory users?

Implement one of the following solutions to prevent Okta User Enumeration Prevention from triggering on known devices.

• Instruct the user to log in using an identifier already known and recognized by Okta.
• Configure the alternate identifier as a valid identifier in the User Profile Policy. Add the identifier by following the instructions in the Add identifiers to a user profile policy documentation.