We're currently experiencing issues with user accounts being locked out due to access attempts from other countries using invalid credentials. We would like to block these attempts based on the location, rather than having them come through as invalid credentials. We want the solution to apply across all applications.

Under the Authentication section, we are already using a Whitelist Network Zone, so sign-on is only allowed from our Dynamic White List. However, this isn't stopping the account lockouts.

I noticed that our "All - Dynamic Blacklist" network zone is inactive. If I change that to active, and add every country except the ones we want, will this achieve what we want (ie will it block the attempt to sign into an application before the credentials are entered, to stop the invalid credential errors)? Do I need to also add a new policy under the Authentication section using this Blacklist, or is it automatically used by default?

Requirement: Block attempts to access Okta based on location, across all applications for both modern and legacy authentication requests, to prevent accounts being locked out due to "invalid credentials" (denial of service attack).