We are looking into some options for MFA and have some questions that I can't seem to find the answers to.

When viewing the video on "Okta Modern Passwordless Authentication" found here: https://support.okta.com/help/s/article/Make-passwords-less-significant-with-Passwordless-Auth, It is mentioned that you can sequentially add factors to the login experience based on the risk of the login. An example given is if Okta sees a login coming from a "new device" with an impossible travel scenario.. My initial question is, how does Okta know what a "new device" is? Is there a flag somewhere in Okta that signifies a known/unknown device?

Thanks!