Authentication Policies & Network Zones

Here is a list of general troubleshooting steps for resolving unexpected MFA prompts or conditional access failures involving Authentication Policies and Network Zones in Okta:

• Check Rule Priority & Order: Authentication policies evaluate rules from top to bottom. Ensure a broader rule is not accidentally matching the user and triggering an unexpected prompt before a more specific rule is evaluated.
• Verify Network Zone IP Configuration: If users receive unexpected prompts because their location is not recognized, verify the Network Zone configuration. If a proxy or VPN is used, ensure both the Gateway IP and the specific Trusted Proxy IPs are properly added to the IP Zone. Wait at least 60 seconds after modifying a zone for changes to propagate.
• Investigate Policy Exclusions: Confirm the user or their group is not inadvertently excluded from the expected policy rule by network zones, device posture conditions, risk levels, or custom Okta Expression Language conditions.
• Align Authentication and Enrollment Policies: Check that the authentication methods required by the Authentication Policy (e.g., phishing-resistant possession factors) are actually permitted and configured (Required/Optional) in the user's Authenticator Enrollment Policy.
• Verify Factor Possession Constraints: If an Authentication Policy requires specific constraints like hardware protection or biometrics/PIN, ensure the user has actually configured their authenticator (like Okta Verify) to meet those constraints. If the user skipped setting up a PIN/biometrics during enrollment, they will fail policy evaluation.
• Review System Logs for Context: Search the System Log for sign-on evaluation events. Check the Client IP to verify network origination, and review DebugContext to identify exactly which policy and rule Okta ultimately applied to the user during the failure

Regards.

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added