Okta Verify Prompt Appears When an Unregistered Device Is Denied Access by an Authentication Policy

Okta prompts users on unregistered devices to open or download Okta Verify due to the inline remediation design in Okta Identity Engine (OIE), even when an authentication policy rule ultimately denies access. Currently, Okta lacks a configuration option to suppress this enrollment prompt for unregistered devices. When an authentication policy rule denies access to an application for users on unregistered devices, users receive a prompt to open or download Okta Verify, despite the System Log recording the user hitting the deny rule.

• Okta Identity Engine (OIE)
• Okta Verify
• Authentication Policy

Okta includes inline remediation for users to enroll in Okta Verify. This feature causes the prompt to appear, even when access is ultimately denied by the policy rule. Okta does not support creating an enrollment policy that results in a deny event disallowing enrollments from unregistered devices.

Why does the Okta Verify prompt appear when access is denied?

While the prompt to open or download Okta Verify appears, Okta still denies access to the application as intended by the authentication policy rule hierarchy. This behavior occurs due to the built-in inline remediation design in Okta Identity Engine (OIE).

Understand the expected behavior of the prompt and enrollment flow, followed by the rule evaluation and access denial process by reviewing the following sequence.

1. When an end user on an unmanaged or unregistered device attempts access, Okta prompts them to open Okta Verify.
2. If Okta Verify is not installed on the machine, Okta prompts the user to download, install, and complete the enrollment process.
3. Once Okta Verify enrollment is completed, Okta evaluates the authentication policy rules in order of priority.
4. The request fails to meet the criteria for the higher-priority rule requiring a registered or managed device.
5. The request falls through to the subsequent policy rule, such as a rule targeting unregistered devices or the default catch-all rule configured to deny access.
6. Okta ultimately denies the user access to the target application.

NOTE: Currently, Okta lacks a configuration option to suppress or disable the Okta Verify enrollment prompt for users accessing from unregistered devices. The authentication policy continues to function as designed by enforcing access denial following enrollment completion.