CharlesG.99538 (Customer) asked a question.
Hello,
We created a Traveling Authentication Policy group that we apply to users who travel to different countries, it basically says if the ip is from anywhere etc. allow access
But we also have a Network Zone rule that blocks countries -- we haven't had much issues with users accessing OKTA overseas until last week. We had a user who we applied the Travel Auth group.. but could not get into OKTA (no user logs of any activity in OKTA that day) -- once we removed the said country from the Network Zone block rule , they were able to access
my question is , from our understanding, that the Authentication we created to allow the users from any IP supersedes the Network Zone block rules. is this accurate ?
Yes, any user that tries to reach your site from an IP or zone that is marked as "IP block list" zone type in the Security/Networks section of the Okta Admin dashboard, will not get a chance to be evaluated via authentication policies.
You can setup zones that are not marked for "blocking", then configure authentication policies that explicitly DENY access when users come from those zones. This however, would not prevent malicious attempts from potentially locking accounts due to multiple failed login attempts.