NagarajanR.41027 (GSA) asked a question.
We are having an inconsistent behavior of the Do not challenge this Device again checkbox checked. The users are getting annoyed after the repeated MFA Challenge answers every time they login.
OKTA Support has provided the following configuration changes to resolve the above issue
Access the OKTA Admin Console
Navigate to Security > Authentication > Sign On
Locate the Sign On Policy in question and locate the Sign On Rule, then click Edit (The Pencil icon)
To modify the number of minutes, hours, or days of the prompt, simply change the Per Session value under Factor requirement section
To remove the prompt, select either Per Device or Every Time and click Update Rule
But we don't see the Factor requirement section in the Sign On Rules. We see Policy settings and session management only. Can someone help us how to get avoid the MFA Challenge Answers even after checking the Do not challenge this device again checkbox.
Hello @NagarajanR.41027 (GSA) Thank you for reacting out to our Community!
If your users are checking the box for "Do not Challenge this device again" and they are still challenged, there could be a few reasons for that:
Please also take in consideration that this setting is working based on the browser cache, if they are removed or not stored then they will be prompted all the time.
I would recommend to review our documentation and based on the type of Okta org you have to adjust the Policy also based on your user's browser settings :
For OIE: https://help.okta.com/oie/en-us/Content/Topics/identity-engine/policies/about-app-sign-on-policies.htm
For Classis :https://help.okta.com/en-us/Content/Topics/Security/policies/configure-signon-policies.htm#:~:text=The%20Okta%20sign%2Don%20policy,on%20policy%20in%20the%20list.
The Okta Community Catalysts Program is now live. Collect online badges when you participate in the Okta Help Center Questions community. Learn more here.
Community members help others by clicking Upvote or Select as Best on responses. Try it today.
We have verified the user's browser settings and the cache is not cleared when the leave the browser. We have tried both in EDGE and Google Chrome and both the browser is prompting to enter the MFA even after checking Do not challenge this device again.
Also we are not seeing the following in the Sign On Rule AND Behavior is AND Risk is
Is the Rule setup for different customers?
Look in the Policy Settings of the sign-on rules, for "MFA lifetime", just above Session management. This is the setting that Paul was referring to.