Block a specific country location?

yfei7 (yfei7) asked a question.

Hi,

How can i block a specific country location from trying to log into Okta?

We are getting alot of accounts locked out by repeated attempts to login from countries our users arent in.

Top Rated Answers

6iga1 (6iga1)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:30 AM
David, I believe this is part of the adaptive MFA product (at least for us, it showed up once we got some licenses for that product). It's called a Dynamic Zone. If you go to Security -> Networks and you have the ability to Add Zone, see if Dynamic Zone is there. Once you create the zone you can use it in policies elsewhere OR you can check the "Blacklist IPs from this zone" to immediately stop those countries from logging in. Blacklisting is the only way to stop the "DDOS" by account lockouts in AD. If you try to use them in other policies for logging in to Okta or particular applications, the lockouts will continue. See my question below regarding Dynamic Geo-Location Zones and AD Account Lock-outs.
Expand Post
Selected as Best

All Answers

6iga1 (6iga1)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:30 AM
David, I believe this is part of the adaptive MFA product (at least for us, it showed up once we got some licenses for that product). It's called a Dynamic Zone. If you go to Security -> Networks and you have the ability to Add Zone, see if Dynamic Zone is there. Once you create the zone you can use it in policies elsewhere OR you can check the "Blacklist IPs from this zone" to immediately stop those countries from logging in. Blacklisting is the only way to stop the "DDOS" by account lockouts in AD. If you try to use them in other policies for logging in to Okta or particular applications, the lockouts will continue. See my question below regarding Dynamic Geo-Location Zones and AD Account Lock-outs.
Expand Post
Selected as Best
tederyl.brown1.488579934623899E12 (Okta, Inc.)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:28 AM
Hi David, TeDeryl here with Okta Support. To provide the best guidance on this issue, I would suggest to open a case with our support team. We do have a feature flag that can help with Geo-Location blocking. This feature will prevent access from any other country than the one's selected for access. I have also added our documenation on 'Networks' for review if needed. https://help.okta.com/en/prod/Content/Topics/Security/Security_Network.htm
Expand Post
yfei7 (yfei7)
8 years ago
Thanks for your help.
Expand Post

This question is closed.