Persona IDV Not Triggering for Self Service Password Reset Despite Configured Okta Account Management Policy
Last Updated:
Overview
Persona or other IDV not triggering as expected for Self Service Password Reset or Account Unlock, despite the Okta Account Management Policy being configured and working for Profile Updates.
Applies To
- Okta Identity Engine (OIE)
- Identity Verification (IDV)
- Self-Service Password Reset (SSPR)
- Account Management Policy (OAMP)
- Persona IDV or Other IDV
- Mixed Environment of Both Okta and Active Directory Users
Cause
The configured password policy does not meet the criteria required to trigger the IDV Account Management Policy. A misconfigured policy prevents Okta from applying IDV as expected during SSPR or account unlock actions.
Solution
To ensure Okta triggers the Identity Verification integration during Self-Service Password Reset and account unlock actions, configure the Okta Account Management Policy and the password policy as follows:
- Create an Okta Account Management Policy that allows access after successful IDV to the configured ID verification service.
-
- Optionally, the OAMP can be scoped to reset and unlock actions with an expression like the following:
accessRequest.operation == 'recover'|| accessRequest.operation == 'unlockAccount'
- Optionally, the OAMP can be scoped to reset and unlock actions with an expression like the following:
- Configure the password policy for the correct credential type for the users, such as Okta or Active Directory.
- Create a password policy for each user authentication provider type that requires IDV functionality. In a mixed environment, administrators might need to create multiple password policies to ensure at least one is scoped to the desired authentication providers.
- Create a password policy for each user authentication provider type that requires IDV functionality. In a mixed environment, administrators might need to create multiple password policies to ensure at least one is scoped to the desired authentication providers.
- The applicable Password policy must also include a Recovery Rule that allows the desired Self Service, and it is set to use the Account Management Authentication Policy for Access control.
NOTE:
-
- Password expiration flows don't enforce the Okta Account Management Policy unless password expiry is enabled.
- Administrator-initiated password reset flows do not enforce the Okta Account Management Policy. The user must select the link in the email, but Okta does not prompt them for additional factors.
If these OAMP policy configurations are correctly in place, and the Password Policy is also correctly configured as outlined above, users receive the IDV authentication experience on SSPR as expected:
