<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D5KZ000019T9gJ0ASOkta Classic EngineAdministrationAnswered2025-07-22T16:40:03.000Z2025-07-21T14:24:57.000Z2025-07-22T16:40:03.000Z

SachinG.26887 (Customer) asked a question.

July 21, 2025 at 2:24 PM
How to make Non-admin users login with password with new trial and integrator tenants?

Hello,

 

In my older Okta Dev account with a URL starting with “dev-“, only the Admin login was prompted for the Okta verify step. However, with the new trial and integrator tenants, it appears that all regular users, including non-Admins, are also prompted for the Okta verify step. This is a significant obstacle for me in adapting the new trial and integrator tenants because my Automation tests run on the cloud and cannot retrieve OTP codes from the Okta verify app.

 

In my older Dev account, I noticed that due to the ‘classic migrated’ authentication policy, non-Admin users were allowed to log in using passwords. I attempted to replicate this with a new custom authentication policy, as shown in the screenshot, but it failed, and the user is still prompted for the Okta verify step.

 

I understand that the new trial and integrator tenants are created using the Okta Identity engine. Could you please provide a solution on how to enable non-Admin users to log in using passwords with these new tenants?

 

Thanks

/help/servlet/rtaImage?refid=0EMKZ000000xI7W

  • 13 answers
  • 223 views

  • HarryL.05482 (Anthropic Identity)

    Got it! You can create multiple rules in the policies so different users get different experiences. You can have an authentication policy rule that is assigned to a group that contains your admins that has MFA. The 2nd rule can be assigned another group, that is everyone else that will only require a password. Note: you can drag rules in order of priority. In the above example, if a user is not a part of the group in rule 1, they will move to rule 2.

     

    The admins will get an admin experience when accessing the admin console as that is a different application to the Okta dashboard.

     

    I would suggest reviewing the following documentation: https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/add-app-sign-on-policy-rule.htm

    Expand Post
    Selected as Best

  • HarryL.05482 (Anthropic Identity)

    You will also need to check the Global Session Policy under Security. It may be enforcing MFA there. Global Session Policy can be configured to "Any authenticator to satisfy the requirements" that will leverage the authentication policies only. Think of it as 2 layers; Global Session Policy, then Authentication Policy.

     

    I hope that helps! Here's some reference material: https://developer.okta.com/docs/guides/configure-signon-policy/main/

     

    Expand Post

  • SachinG.26887 (Customer)

    Thanks, Harry, for your response. The Global Session Policy already had “Any authenticator to satisfy the requirements” and the MFA was set to ‘Not required’ as shown in the attached screenshot.

     

    I attempted to switch the ‘Establish the user session with’ to ‘password’, the Password field was displayed on the Sign-in page but after entering the credentials, MFA Okta Verify step was still displayed.

    Here’s a screenshot of a non-admin user requesting MFA Okta Verify step.

    Global Session Policy Screenshot 

     

    Expand Post

  • HarryL.05482 (Anthropic Identity)

    You are actually being prompted with an MFA Enrollment flow. If you go under Security -> Authenticators, then look under the enrollment tab. You will see the policy you are hitting for enrollment. You are being asked to enroll in the favor but that may not result in needing it to authenticate.

  • SachinG.26887 (Customer)

    It appears that there is only one default policy in the Authenticators -> Enrollment -> Default Policy section (screenshot attached). The default policy indicates that ‘Okta Verify’ is an optional step. However, as shown in the earlier screenshot, a non-admin user cannot proceed unless they configure the Okta Verify. The earlier screenshot also shows a ‘Required now’ label for the Okta Verify step!

    Authenticators -> Enrollment -> Default Policy

    Expand Post

  • HarryL.05482 (Anthropic Identity)

    Where are the users signing into? You have shown the policies for the Okta Workflows Application. If they are signing into the Okta dashboard, you'll need to check the policy for that application as well. Or add the Okta dashboard to the password only policy.

  • SachinG.26887 (Customer)

    Yes, users sign into the Okta dashboard application and then launch a custom app (application tile from the dashboard) assigned to them, as shown in the screenshot.

     

    If I update the Okta dashboard app, I believe it will also apply to Admins. However, removing the MFA factor for Admins would make the tenant unusable.

     

    Harry, I appreciate your assistance in guiding me through this problem.

    Okta Dashboard with Custom SSO App

    Expand Post

    • HarryL.05482 (Anthropic Identity)

      Got it! You can create multiple rules in the policies so different users get different experiences. You can have an authentication policy rule that is assigned to a group that contains your admins that has MFA. The 2nd rule can be assigned another group, that is everyone else that will only require a password. Note: you can drag rules in order of priority. In the above example, if a user is not a part of the group in rule 1, they will move to rule 2.

       

      The admins will get an admin experience when accessing the admin console as that is a different application to the Okta dashboard.

       

      I would suggest reviewing the following documentation: https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/add-app-sign-on-policy-rule.htm

      Expand Post
      Selected as Best

  • SachinG.26887 (Customer)

    So, I created two rules: one for Okta Administrators and the other for Non-Okta Administrators.

     

    After applying the rule, Non-Okta Administrators users are now able to log in using their passwords. 🎉

     

    However, the Admin is unable to log in. 😞

     

    Fortunately, I have an API token, and the Admin session is still active. Could you please review these policies and let me know what I need to do to enable the Admins to log in?

     

    I didn’t update the Catch-all rule. For completeness, I’ve attached the complete page screenshots.

    CatchAll rule of Okta Dashboard Authentication PoliciesNew Authentication Policies for Okta DashboardThanks in advance.

     

    Expand Post

  • HarryL.05482 (Anthropic Identity)

    It looks like you're requiring Okta FastPass for Admins. However, it may not be enabled under Authenticators -> Okta Verify (Edit) -> Check Okta FastPass Box. Hence the "unable to sign in" error.

     

    Either enable Okta FastPass under authenticators, OR change the Admin rule to allow Okta Verify Push/TOTP and you should be good to go!

    Expand Post

  • SachinG.26887 (Customer)

    Ah, I see why you asked me to check this step. However, the ‘Okta FastPass Box’ was already enabled in the /admin/access/multifactor section.

     

    I also enabled the ‘Push notification (Android and iOS only)’ option.

     

    I’m not sure if simply re-saving the authenticators resolved the issue or if adding the ‘Push notification (Android and iOS only)’ option was the solution. Regardless, the problem has been resolved 🙏

    • Admin login - showed password and Okta verify Push flow
    • Non-admin login - showed only password flow

     

    Okta fast pass status 

    I have a different sub-question, if you could enlighten me on this too:

    • In the 'Catch-all Rule', 'Allowed with any 2 factor types' shows all these options: Password or Okta Verify - Push1 or Okta Verify - FastPass1
    • But in the 'AdminOnly2FA', 'Allowed with any 2 factor types' shows only 'Password or Okta Verify - FastPass'.

    Why does the 'AdminOnly2FA' show different 2 factor types when compared to the 'Catch-all Rule'?

    Okta Dashboard authentication-policies

    Expand Post
10 of 13
This question is closed.
Loading
How to make Non-admin users login with password with new trial and integrator tenants?