Self-Service Password Reset Shows Unenrolled Authenticators
Dec 3, 2025
Okta Identity Engine
Administration
Overview
When a user attempts to reset a password after selecting Forgot password?, options to reset via email and Okta Verify appear. This occurs even if the user has not enrolled in Okta Verify.
Applies To
- Okta Identity Engine
- Self-Service Password Reset
Cause
This behavior is controlled by the password policy and the Okta Account Management Policy settings.
Solution
Use the following Okta Account Management Policy rule expression:
accessRequest.operation == 'recover'This expression ensures that the policy rule applies specifically to recovery scenarios. When combined with the authenticator settings in the rule, Okta only presents the recovery options that the user enrolled in during these flows.
