Okta Certified Administrator · Part I

Security

20% of the exam — the third-largest domain.

Security

Module 1: Okta Security Policy & Enforcement Framework

7 sub-topics · this deck covers sub-topic 5 of 7

The Exam Bullet

"Demonstrate understanding of adaptive MFA policies"

Not every login looks the same. Adaptive MFA is about noticing when one looks different — and reacting to that, without just locking everyone out by default.

The Mechanism — Behavior Detection

Behavior Detection analyzes patterns of user activity and builds profiles of typical behavior based on prior activity — tracking things like sign-ins from a new geographic location or access from an unfamiliar device.

Admins configure which behavior types to track and when a change should trigger a response — e.g., "require MFA if a user signs in from a new location or uses a new device."

The Gotcha — It Can't Deny, Only Escalate

Behavior Detection cannot be configured to deny user access based on behavioral anomalies. Its only role is to inform adaptive controls like MFA requirements.

This is a precise distinction the exam can test directly: anomalous behavior triggers a step-up challenge, never an outright block.

The Exam Angle

Watch for scenario questions built around this trap:

→ "Can Behavior Detection block a login outright if it looks suspicious?" = No — it can only trigger additional MFA, never deny access on its own.

One Line To Remember

Behavior Detection builds a baseline from prior activity (location, device) and integrates with sign-on policies to trigger step-up MFA when something's new — but it can never deny access outright; that's a hard limitation, not a configuration choice.

Sources: help.okta.com — proc-security-behavior-detection.htm

Next: Sub 6 →