Okta Optional Email Enrollment Not Working
Last Updated:
Overview
Okta automatically enrolls users in the Email Authenticator, rather than displaying the optional enrollment prompt, when administrators enable the "Enable optional email enrollment for Okta Identity Engine" feature. This occurs because the password policy specifies the Email Authenticator as the only available account recovery method. Administrators must configure additional recovery authenticators in the password policy and reset the Email Authenticator for users created before the feature was enabled to resolve this issue.
Applies To
- Optional Email Enrollment
- Early Access Feature
- Okta Identity Engine (OIE)
Cause
Okta automatically enrolls users in the Email Authenticator when the password policy specifies Email as the only available account recovery method. Users must enroll in at least one recovery authenticator, which forces automatic enrollment if no other options exist. Additionally, Okta automatically enrolled users created before the administrator enabled the optional email enrollment feature.
Solution
How do administrators resolve the automatic Email Authenticator enrollment issue?
When configuring self-service account recovery, administrators must specify the authenticators that end users can use to reset a password or unlock an account. End users must enroll in at least one of these authenticators: Okta Verify, Phone, Email, or Google Authenticator. If the policy specifies Email as the only authenticator for account recovery, Okta forces end users to enroll the email as an authenticator.
Review the following image showing the Enable optional email enrollment for Okta Identity Engine feature toggle.
Configure Additional Recovery Authenticators in the Password Policy
Navigate to the Authenticators page in the Okta Admin Console to verify the password policy rules and configure additional recovery authenticators by following these steps:
- Sign in to the Okta Admin Console, select Security, and choose Authenticators.
- Select the Password row, select Actions, and choose Edit.
- Scroll to the Rules section of the Authentication Policy and verify that the THEN Users can perform self-service section has either Password reset or Unlock account selected.
Review the following image for an example of the self-service action settings.
- Scroll to the Recovery authenticators section.
Review the following image for an example of the recovery authenticators section.
- In the AND Users can initiate recovery with section, verify that Email is either not selected or is not the only option selected. All users subject to this password policy must have access to at least one of the selected options.
NOTE: Okta automatically enrolled all users created or provisioned before the administrator enabled the feature in the email factor. Administrators must reset the Email Authenticator for these users to display the optional enrollment prompt.
Review the following image for an example of the desired optional email enrollment screen.
