<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008C3jTXSAZOkta Classic EngineMulti-Factor AuthenticationAnswered2024-04-16T13:01:02.000Z2018-07-03T08:42:56.000Z2018-07-03T08:42:56.000Z

cxnuc (cxnuc) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM
MFA in Hub - Spoke configuration / bookmark app
Hi,

We have a setup where we require MFA when outside the network for apps in our hub org.

 

Now we have in a spoke org setup a bookmark app pointing to this app in the hub.

When accessing this bookmark we also get prompted for MFA when outside the network.

 

Is this normal behavior  or can we have different settings on the bookmark app in the spoke than in the app in the hub (so it would not require MFA when logging in to the bookmark app on the spoke)
  • 1 answer
  • 934 views

  • evan.alter1.4865287258752158E12 (Okta, Inc.)

    Hello, Winfried -

    You are prompted for MFA when clicking on the bookmark app (when off-network) because the MFA policy is applied to the app in the Hub org (or the entire org).

     

    This is the expected behavior. Even though the authentication flow begins in an app (the bookmark) that does not require MFA, the destination still requires it.

     

    You might be able to bypass the MFA challenge to the app if: 
    • The MFA challenge is part of an app-level sign on policy (rather than org-level).
    • The end users who access the bookmark are in a discrete group.
    • A new rule is created that allows this group access to the app, but does not challenge for MFA.
    • This rule will need to be higher in the priority list than the rule that challenges for MFA; rules are evaluated in order of priority.
     

    Will this work for you?

     

    Evan Alter

    Technical Support Engineer

    Okta Global Customer Care
    Expand Post
This question is closed.
Loading
MFA in Hub - Spoke configuration / bookmark app