ug2d5 (ug2d5) asked a question.
Hi all, not sure if anyone has seen or dealt with this before.
We recently performed the upgrade to OIE, and noticed something that wasn't mentioned in the documentation or "list of changes" from Classic to OIE.
We require Email MFA to be used for certain users who do not have a mobile phone.
After the upgrade, we have noticed that when logging in from a new browser, any/all users are prompted to "verify" with either email or password. It appears to allow the user to use an email magic link in place of their password.
The behaviour/flow looks like this:
1 Navigate to the Okta Sign On page from a new browser/incognito:
2 Click Next
3 User is asked to use either Email or Password to Verify
4 Once either option is satisfied, the user is prompted for any MFA required, e.g. Okta Verify push notification.
Note, this is different to "Email MFA", this is specifically allowing email to be used in place of the password.
I'm wondering if anyone knows how this can be disabled, and password can be set as the only option, like how it used to be.
Unfortunately, this option to use either email or password shows for all users, even if Email MFA is set to "Disabled" under the authenticator enrollment policies.
In the Authenticators page, email is set to allow for Authentication+Recovery, and in my testing, setting it to Recovery-only fixes this. However, it also removes the option for email to be used as MFA, meaning a subset of users can't log in at all because they have no valid MFA configured...
We need the sign on screen to only use email + password, as we will otherwise need to train users to ignore the email option and select password.
Has anyone seen or dealt with this before?
I created a case with Okta, and they found what was causing this flow to occur.
For anyone else who finds this, it is caused by a feature called "User Enumeration Prevention".
You can read about it here:
https://help.okta.com/oie/en-us/Content/Topics/Security/Security_General.htm
To disable it:
Once this is disabled, you should no longer be asked to choose between password or email for a login from a new device.
I also tested with an additional sandbox environment by removing all app authentication policies except ones that asked for only password, and unfortunately it still asked for email and password. The issue only resolved once User Enumeration Prevention was disabled.