Okta Step-Up Authentication for Office 365
Last Updated:
Overview
The Step-up authentication for Office 365 feature enables Okta to dynamically prompt for Multi-Factor Authentication (MFA) when required, eliminating the need for a two-factor authentication rule in the Office 365 Authentication Policy. Enabling the Okta MFA from Azure Active Directory (AD) setting causes an authentication loop for users if a single-factor rule triggers in Okta while Microsoft requires a second factor. Enabling the Step-up authentication feature resolves this loop by allowing Okta to read the assertion and prompt for the necessary second factor dynamically.
Applies To
- Okta Identity Engine (OIE)
- Microsoft 365 (O365 / M365)
- Azure Active Directory (AD)
- Single Sign-On (SSO)
- Multi-Factor Authentication (MFA)
- Okta MFA from Azure AD
Cause
Enabling the Okta MFA from Azure AD setting establishes a trust relationship where Microsoft stops prompting users to enroll in and use the Microsoft Authenticator application. Instead, Okta must provide the required MFA token, which Okta can only access after the user completes a second-factor prompt. An authentication loop occurs when a single-factor Office 365 authentication rule triggers in Okta, but a second MFA requirement or Conditional Access Policy exists in Microsoft. This mismatch forces Okta to attempt to provide two MFA tokens to grant access to the Office 365 product.
Solution
How does the Step-up authentication for Office 365 feature resolve the authentication loop?
The Step-up authentication for Office 365 feature is generally available in all tenants. This feature ensures that the Office 365 authentication rule no longer requires a two-factor authentication (2FA) setup, which previously affected flows that did not require MFA on the Microsoft side. This setting allows Okta to read the assertion and dynamically prompt for the necessary second factor when a user accesses an Office 365 product protected by MFA requirements, even if a single-factor rule triggers in Okta.
