Hello Solomon,

There are two security questions in Okta. There is a security question used with MFA, and there is a separate security question for self-service recovery, which includes password resets. Resetting the security question for MFA will not reset the security question for self-service recovery.

There is no option for an admin to reset the security question for self-service recovery. If the user has forgotten the answer to their security question, they will need to contact an Okta admin to have the password reset. You can reset the password by pulling up the user's profile in the Okta admin console and click the "Reset Password" button.

Once the user is able to login again, instruct the user to go to their Okta dashboard, navigate to the Settings page, and then there will be a "Forgot Password Question" box where they can change their security question/answer.

using okta API you can change recovery question and answer.

{{url}}/api/v1/users/{{userId}}/credentials/change_recovery_question

download postman and okta collection for postman called "Users". you will find within an api end-point called "Credentials operations" which will allow you to manipulate user's security question in the post request body:

{

 "password": { "value": "{{password}}" }, 

  "recovery_question": {

   "question" : "What happens when I update my question",

   "answer": "My recovery credentials are updated" 

  } 

}

Hi all, Just solved this. Go into the admin dashboard, directory, and to their profile. Instead of sending them a reset password link you need to create a temporary password. Provide this to the user (encrypt the email of course if sending it) and when they login they will be challenged to create a new password and then to provide their 2-F key (if enabled for your org). Then they'll be signed in and be able to go into their account settings and change the blasted question.

I'd like to add something to Gabriel's answer.

If When an admin resets the user's password via the "Reset Password" button, if the admin selects "Reset Password Link" the user will still be prompted to answer their password recovery question after clicking the link.

To reset the user's password without needing the answer to the password recovery question, the admin must click "Temporary Password" after selecting the "Reset Password" button. After supplying the user with the temporary password in some secure fashion, the user can use it to login one time and create a new password. Once the user is able to log in, they can go to their profile and update their password recovery question.

Hope this helps.