Hi Sashi,

I'm a CSM here at Okta. Hopefully my answers below can be of assistance.

1. You must disable the email factor in all of your policies before marking the factor itself an inactive. When your users sign in following this change, you will likely want them to enroll in a different factor. To do so, ensure that other factors you select are activated as factors, that they are included as either optional or required in a policy, that your policies are stacked in order, and that a rule is applied to the policy that denotes when you'd like the user to enroll in the factor(s).
2. For new users, enrolling in Okta Verify is detailed here: https://help.okta.com/en/prod/Content/Topics/Mobile/okta-verify-setup-new.htm. End users can only register one device with Okta Verify at a time. To register a new device, end users must reset their Okta Verify account and then open Okta Verify to add and register their new device. Otherwise, I would recommend ensuring that the factor is marked as required or optional and the rule details when the enrollment should occur (first log in, first MFA prompt, do not enroll.)

Here is some documentation that should assist: https://help.okta.com/en/prod/Content/Topics/Security/MFA.htm

Also, if you ever need assistance providing direction directly to end users, don't forget our End User Toolkit is available and full of reference materials and templates: https://support.okta.com/help/s/end-user-adoption-toolkit

Please let me know if this information was of use!

Best,

Sara

Thank you so much for your response Sara. On point 1, have a further question.

Lets say, User 1 is enrolled into both Security Questions and Email as factors. I am then disabling email as a factor to be enrolled (and enabling lets say SMS and making it optional). Will this apply only for future enrollments? Will user 1 see Email as an option when he logs in next time? If so, any way i can ensure he does not see it?

Best

Sashi Sivakumar

Hi Sashi,

While I'm not an engineer, I did test this out in my test instance. If you disable a factor it should not be available, even if it had previously been used. I'd make sure that you have your users enrolled in a second factor at least and let them know that email will be removed as an option. You can even make email optional for a short time before totally disabling it if you want to ensure everyone is sufficiently enrolled. I'd test it out in your test instance too, but that is what I found from playing around with the policies and enrollment!

Best,

Sara