← Course Home
Okta Certified Administrator · Part I

Security

20% of the exam — the third-largest domain.

Security

Module 1: Okta Security Policy & Enforcement Framework

7 sub-topics · this deck covers sub-topic 2 of 7

↑ Module 1 Overview

The Exam Bullet

"Configure global session policies"

Once a user is identified, something still has to decide what happens next: let them in, challenge them, or start a fresh clock. That's the global session policy's job.

The Mechanism

Global session policies establish the requirements for users to progress through authentication steps after initial identification — controlling actions like allowing access, prompting for a challenge, and setting the time before the next challenge.

Every org has a default policy applied automatically to all users (permitting password, IdP, or app-approved factors). Admins can modify it directly or layer higher-priority rules on top.

The Gotcha — LDAP Interface

Okta Global session management settings are disabled when users authenticate using the LDAP interface.

This isn't a bug — it's a documented limitation for directory-based authentication via LDAP.

The Workaround — MFA Over LDAP

Since normal session policy enforcement doesn't apply, MFA over the LDAP interface works through credential string syntax instead:

"password,MFAtoken" — e.g. "password,123456"
"password,push" — triggers a Verify Push approval/denial prompt

If the user is enrolled in Verify Push and doesn't append ,push, the push notification is sent automatically.

The Exam Angle

Watch for scenario questions built around this trap:

→ "Global session policy changes aren't taking effect for a set of admin users." = check if they're authenticating via the LDAP interface — session policy is disabled there.

One Line To Remember

Global session policy = post-identification rules (allow/challenge/re-challenge timing), with a default org-wide policy plus optional higher-priority rules. Disabled entirely for LDAP interface auth — which instead uses credential syntax like "password,123456" or "password,push" for MFA.

Sources: help.okta.com — about-okta-sign-on-policies.htm · LDAP-interface-MFA.htm