We are trying to set up(I am not part of the setting up process) an SSO based login for an ITSM application. Our organisation has some users working for us although they use their own organisation email address to log in. We use OKTA as our IdP.

When the set-up is complete, I can see that for internal users the user tries to log in to the ITSM application, then redirected to OKTA. Authenticates with email/pass on OKTA and back to ITSM.

For external users, the process is the same except that the users are challenged for MFA.

My question is how does our OKTA tenant know that the user is external or internal to prompt for MFA token challenge? Is it something in the set-up that you can specify that the user(based on email) is external and prompt for MFA?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.