Resetting a user behavior profile causes the risk level to increase to high because Okta clears all historical login data and treats subsequent attempts as anomalous. The risk level naturally decreases as the user successfully logs in and establishes a new baseline. Administrators observe a high risk level in the System Log with reasons such as anomalous location and anomalous device.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Risk Engine
• Behavior Profiles

When an administrator resets a user behavior profile, Okta clears all historical login data. Because a known baseline no longer exists for comparison, the Okta Risk Engine treats all subsequent login attempts as completely new and anomalous. As a result, Okta defaults to assigning a HIGH risk level. This is expected behavior.

The System Log reflects this behavior with the following reasons:

reasons=Anomalous Location, Anomalous Device, level=HIGH

Since Okta wiped the behavior profile, Okta views the standard location and device as completely new or anomalous.

• Anomalous Device: This triggers if the user clears the browser cache or cookies, uses a private browsing window, updates the browser (changing the User-Agent string), or switches to a different browser entirely. Okta relies on a device token cookie to recognize known devices.
• Anomalous Location: A corporate Virtual Private Network (VPN), a mobile hotspot, or the Internet Service Provider (ISP) dynamically re-routing traffic through a different data center or city triggers this reason.

How is a high risk level resolved after a behavior profile reset?

If a user cannot log in to an application due to the application sign-on policy evaluating the risk level, review the Application Sign-On Policy Risk Level Denies User Access article to resolve the issue.