Okta MFA Factor Enrollment & Deactivation

Lacey Cochrane@NullVectorX

•updated May 7, 2026•3•0•147

Detects Okta Multi-Factor Authentication (MFA) factor enrollment, activation, update, and reset events. These events may indicate an attacker adding their own MFA factor post-compromise to maintain access or removing an existing factor to weaken account security and facilitate unauthorized access.