Okta Behavior Detection Repeatedly Flags the Same Location as a New City
Last Updated:
Overview
Okta Behavior Detection repeatedly flags the same location as a new city or country in the System Log, even after multiple authentications from that location. This occurs because Okta evaluates non-interactive background authentications for risk but does not save them to the behavior history. Perform a manual, interactive login from the new location to add it to the trusted behavior history and resolve the issue.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Behavior Detection
- System Log
Cause
Okta evaluates each login against a saved history of past locations. Okta evaluates and saves interactive logins, where an individual actively signs in via a browser, to the behavior history. Okta evaluates non-interactive or background authentications, such as automated scripts, token refreshes, or background services, for risk but does not save them to the history. This design prevents automated processes from polluting a legitimate behavior profile.
When a background script authenticates from a new location, Okta flags it as a new location but discards the location data. Subsequent background authentications from the same location continue to trigger the detection because Okta never adds the location to the history.
NOTE: Individual micro-steps in the System Log, such as evaluating a sign-on policy or verifying identity, do not count as separate authentications. Only a completely successful sign-in flow, represented by a user.session.start event, counts as a single authentication for behavior history.
Solution
What resolves repeated behavior detection?
Add the new location to the trusted behavior history by performing a manual login from the affected environment.
- Access the environment or virtual machine generating the background authentications.
- Open a web browser.
- Perform a manual, interactive login to Okta.
An interactive login updates the behavior history.
Review the System Log to confirm Okta trusts the location by observing the following behaviors.
- Okta records the interactive session in the behavior history.
- Subsequent background authentications from that location no longer trigger the new location detection.
