Account recovery is possible with a security question in Okta Identity Engine. This is different from the configurable recovery questions in Okta Classic.

• Okta Identity Engine (OIE)
• Secret Question Configuration

In OIE, when the Security Question authenticator is enabled, only the pre-set questions that are already created can be used, and custom questions cannot be created globally. Only an end user can manually create their own secret question during enrollment.

Review all of the out-of-the-box secret questions. This can be done via enrollment or by running the following

Option 1: via API call: 

GET /api/v1/users/${userId}/factors/questions

Option 2: via GUI:

Users can create a custom security question within their account. However, admins cannot create a global custom question available to all users. There is also no way to turn off the ability for users to not create a custom security question for their account that other people will not know the answer to.