This article clarifies how to retrieve the total number of users enrolled in specific Multi-Factor Authentication (MFA) factors. The available methods include using the Okta Admin Console reports or executing an Application Programming Interface (API) request.

• Multi-Factor Authentication (MFA)
• Reports
• Application Programming Interface (API)
• Okta Classic Engine
• Okta Identity Engine (OIE)

Use one of the following methods to retrieve the total count of users enrolled in specific factors.

Method 1: MFA Enrollment by User Report

A detailed report of user factor enrollment is available directly from the Okta Admin Console. The MFA Enrollment by User report displays which authenticators each user has enrolled in and can be filtered to show only specific factors.

1. In the Okta Admin Console, go to Reports > Reports.
2. In the Multifactor Authentication section, select MFA enrollment by user.
3. Select Edit Filters and choose Authenticator type as the field.
4. Select the specific factors required.
5. Select Apply to view the report on-screen, or select CSV Export to download the data.

NOTE: The exported CSV file requires manual data manipulation to tally the final counts.

Method 2: Postman API Requests

Postman Runner can be used to tally MFA enrollments.

Step 1: Create the Request to Get All Users

This request fetches the list of users from the Okta organization.

1. Create a new request in Postman.
2. Set the request method to GET.
3. Enter the following Request URL: https://<okta_domain>/api/v1/users.
4. Go to the Authorization tab and set the Type to API Key.
5. Enter Authorization for the Key and SSWS <api_token> for the Value.
6. Select Header for the Add to field.
7. Go to the Headers tab and ensure the following are set:
   1. Accept: application/json
   2. Content-Type: application/json
8. Select Send.

The response body contains a JSON array of user objects. The id from each user object is required for the next step.

NOTE: If the organization has more than 200 users, Okta paginates the results. Copy the next link found in the Link header of the response and use it in a new request to get the next page of users. Repeat this process until all users are retrieved.

Step 2: Create the Request to Get Factors for a User

For each user ID collected in the previous step, make a request to get their enrolled factors.

1. Create a new request in Postman.
2. Set the request method to GET.
3. Enter the following Request URL: https://<okta_domain>/api/v1/users/<userId>/factors.
4. Replace <userId> with the actual user ID copied from the previous step.
5. Set up the Authorization and Headers exactly as configured in Step 1.
6. Select Send.

The response is a JSON array of all the MFA factors that the specific user is enrolled in. The factorType field (for example, webauthn, token:software:totp for Okta Verify, sms) contains the required factor information.

Step 3: Getting the Final Counts

To get the final counts, execute the following actions:

1. Execute the "Get All Users" request.
2. For each user in the response, copy the user's id.
3. Paste the id into the URL of the "Get Factors request" and execute it.
4. In a separate text file or spreadsheet, tally the factorType from the response.

NOTE: Use Postman Runner to iterate over each user and automatically retrieve the total numbers. While manual iteration is possible, scripting is more efficient for a large number of users.

Additional Information

Upon upgrading to OIE, additional tools are available to easily access this information. A chart is provided that breaks down the number of users enrolled in each factor. For more information, refer to How to Generate the MFA Enrollment Report.

Related References

• How to Generate the MFA Enrollment Report
• Postman Runner (Third-Party Tool)