When is the Last Used Date Updated in the MFA Usage Report
Last Updated:
Overview
This article explains how the last used date information is fetched when generating the MFA Usage report.
Applies To
- Multi-Factor Authentication (MFA)
- MFA Usage Report
- System Log
Solution
The report provides a list of all authenticator enrollments based on authentication activity from users when they sign in to their accounts.
When the MFA Report is generated, each row is based on an enrolled authenticator for each user.
The Last Used_ISO8601 field in the MFA Usage Report should reflect the last time that particular MFA Factor was used by a user to verify their credentials when authenticating, regardless of whether the user was signing into the Okta Dashboard or a different application within their Okta tenant.
A user's MFA usage can also be verified in the System Log by using the following search query:
(actor.id eq "userId" or target.id eq "userId") and eventType eq "user.authentication.auth_via_mfa"
When expanding the returned logs, the method used is shown under the Factor section:
NOTE: There is a difference between Okta Verify and Okta Verify Push in the report:
- Okta Verify Push: Logged when confirming the push notification received from the Okta Verify app.
- Okta Verify: Logged when manually fetching the OTP code from the Okta Verify app and entering it in the Okta Sign-in Widget.
