Okta Certified Administrator · Part II

Security Enforcement

23% of Part II — the final and most policy-heavy use case.

Task 4: Create an Authentication Policy for MFA

5 tasks · this deck covers task 4 of 5

The Task

"Create an authentication policy for multifactor authentication"

This is the app-level layer — distinct from the global session policy (Task 3). An authentication policy (also called an app sign-on policy) is what governs a specific application.

The Mechanism

"App sign-in policies define how a user must authenticate to gain access to an app." They check conditions like group membership, IP location, and risk assessment before granting access.

The Structure

Default Policy — every new app gets a shared default with one catch-all rule requiring two-factor authentication
Customization — orgs can build unique policies per app, or share one policy across multiple apps
Presets — Okta provides ready-made policies for standard authentication needs
Rules — admins can add multiple rules to a single policy

A Related Capability

Beyond app access itself, account management policies control authentication requirements during authenticator enrollment/un-enrollment, password recovery, and account unlocking — related but separate scenarios from the app sign-in policy itself.

The Angle — What Trips People Up

Watch for this in your own sandbox run:

→ Building a brand-new policy from scratch when a preset already fits the need — check presets first.

→ Confusing an app sign-in policy with an account management policy — enrollment/recovery/unlock scenarios are governed separately.

One Line To Remember

Every new app gets a default policy with one catch-all 2FA rule. You can customize per app, share policies across apps, use Okta's presets, or add multiple rules. Account management policies (enrollment, recovery, unlock) are a related but separate mechanism.

Sources: help.okta.com — about-app-sign-on-policies.htm

Next: Task 5 →