himoc (himoc) asked a question.
Adding Multiple MFA Apps and letting the user decide anyone configure
Currently, the System is configured with Okta Verify and Google Authenticator as the Authenticators App. Okta is list these two while the user configures the user account as expected. This enables the user to configure one or both apps as an MFA app. This behaviour is okay, but I don't want the user to set up both. If they chose one and completed the setup, the system should not be asking for the second one to set up. Currently, okta gives a skip option, but I just want the user to continue to log in after setting up any one MFA.
Not sure how to configure this!
My Current Auth Rule :
Image is not available
Hi @himoc (himoc) , Thank you for reaching out to the Okta Community!
If I'm understanding this correctly, what you are describing is the Authenticator (MFA) enrollment flow(policy).
There currently is no "either one OR the other" type functionality; Just "Required AND/OR Optional" for Authenticator enrollment if we're talking about the initial login.
Once an Authenticator has been set up and the other has been skipped (if set as "optional"), subsequent login attempts should just prompt the user to login with that one and they'll have the option to set up the other from their end-user settings page.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Community members help others by clicking Like or Select as Best on responses. Try it today.
Hi @Mihai N. (Okta, Inc.) Negoita , thank you so much for the response.
My issue is a bit different; I don't want the second MFA Authenticator enrollment to be displayed as the first one is already completed. The MFA Authenticator config needs to be like this: anyone to be enrolled (the one user selected from the list), if one is completed, redirect the user to the next process, not to the second MFA setup.
Thanks
By default, the end-user is presented with the option to enroll one, several or all available Authenticators just the first time the enrollment rule is triggered. They have to choose at least one as per the enrollment rules and enroll with the others or skip them as desired. Once they have done so and signed into Okta or an application that you set up, the next time they sign in (for example the next day), they will not be prompted to enroll.
If you are experiencing a different behavior, I recommend that you open a case and go over your configuration with one of our Support Engineers.