Hi @SvcBancsAPITestT.08169 (Customer)​ , Thank you for reaching out to the Okta Community!

To answer your questions: 

1. The verification email is sent to validate the address which is then set as primary email address. An attribute that can/will later be used for authentication purposes as an Authenticator (MFA) or for Password reset emails and so on.  
2. You mentioned that "the user is immediately active, but gets sent to the recovery question page" - this is expected in accordance to the Password Policies you have in place (Please see https://help.okta.com/en-us/Content/Topics/Security/policies/configure-password-policies.htm for details). If you disable the requirement for a Recovery Question (users may also be prompted for a phone number if you have SMS/Voice Call recovery activate), the users should be directed to their Okta Dashboard. Please see https://support.okta.com/help/s/article/How-to-disable-the-recovery-security-question?language=en_US for details on how to do this. 

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope it helps!