Hi Mike,

This is certainly attainable with AMFA using a combination or Authentication and Multi-factor policies.

Essentially, you'll do the following at a high level

1. Create a group for each user type
2. Assign a Multi-factor Enrollment Policy to force users to enroll for Okta Verify and Security Question. (Factors must be activated and they must be required in the MFA Enrollment Policy)
3. Assign the group(s) to new Authentication Sign-On policies for each factor type. (i.e. Group 1: Forgot Users, Group 2: All Employees
   1. This is also where you define network location. (If Users IP Is - Not In Zone)
      1. NOTE: Network Zones must be defined already for this to work as expected.
   2. Set the policies to prompt for factor and set the "Session Expires After" to the desired setting.

Additional Reading:

• Network Zones - https://help.okta.com/en/prod/Content/Topics/Security/Security_Network.htm
• Security Policies - https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm

Thanks for the reply, I think the bit that’s missing is where I can choose which factors can be used?

I only want users to be able to use security questions if I put them in a group for it. When I look in auth policy I only get ‘prompt for factor’ yes/no; what I am looking for is a way to choose what factors are valid.

The way you design the policy is completely up to you. That said, what you're looking for is located in Security/Multifactor/Factor Enrollment tab. I mentioned this above but unfortunately the formatting of my reply didn't retain the bullet points to make it easily readable. You'll essentially created two Factor Enrollment policies, one for Okta Verify and one for Security Question and assign to the appropriate user population.

I've tried it that way; the bit that's missing is that it doesn't allow me to have ALL users, from day 1 of deployment, enrol the Security Question but not use it (because the are part of 'everyone') whilst later being put into 'forgot phone' and then using their pre-enrolled security question.

Ie If everyone doesn't have the Security Question factor enabled, they don't seem to enrol it. If everyone does have it enabled then they can use it. Neither of these is desirable.

If I then put a user in the 'forgot phone' group they have to enrol the security question on first use, which might be while they are travelling; at the moment we've taken the view that factors should only be enrolled on site.

I suspect this is a current limitation we can't get around.

All users can be enrolled for both factors like you're asking. Okta has no way to know that a user left their phone.

What happens is these users will be required to enroll for both factors upon next login ideally. When a user is prompted for MFA they have both factors enrolled but only one is there primary. Okta provides a drop-down to choose the factor. If the user forgets their phone they would use that drop-down and choose the secondary MFA factor they enrolled.

The other option is to only provide a secondary MFA option when those users call in to your Help Desk and add to the corresponding group that enforces that policy.

Hope that's helpful for you.