This article explains why end-users may see password recovery options that do not appear to be enabled in their assigned password policy. 

For example:

1. Select only Email as a recovery option.

2. Trigger the self-service password reset flow. 
3. The user is offered the possibility to use other factors besides email.

• Okta Identity Engine (OIE)
• Account Recovery
• "Users can initiate recovery with" Password Policy 

This issue occurs when the User enumeration prevention feature is enabled with the Recovery option selected. This security feature changes the account recovery experience to prevent attackers from discovering which authenticators a user has enrolled.

To change this behavior, disable the Recovery option within the User enumeration prevention settings.

1. In the Admin Console, go to Security > General.

2. In the User enumeration prevention section, select Edit.

3. Clear the Recovery checkbox.

4. Select Save.

After completing these steps, the account recovery page will only display authenticators that the user is enrolled in.

Related References

• General Security
• Self-service account recovery