Okta blocks specific username parts in passwords when the password policy enables Does not contain part of username. Okta applies this rule by splitting the username at punctuation and blocking full parts that contain four or more characters.

Users encounter this behavior during password reset when a new password includes a blocked username part.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Management and Monitoring
• Password policy
• Password reset
• Does not contain part of username requirement

Okta treats this behavior as expected when the password policy enables Does not contain part of username.

• Okta evaluates the username as parts separated by punctuation, such as ., ,, —, _ , #, +, and @.
• Okta does not evaluate any username part with fewer than 4 characters.
• Okta blocks full username parts that contain four or more characters.
• Okta does not block partial matches.

How does Okta evaluate username parts in passwords?

The following details explain how the password policy applies during password reset and what content Okta allows in a new password.

1. Review the username and identify each part separated by punctuation.
2. Exclude any username part that contains fewer than four characters.
3. Avoid any full username part that contains four or more characters when creating the password.
4. Use partial portions of a blocked part if the password policy allows them.

The following example shows how Okta evaluates a username during password reset.

• Username: <Test1234@atko.email>
• Okta blocks the full part Test1234 in a password, regardless of letter case.
• Okta may allow incomplete portions such as test, Test, or 1234.
• Okta evaluates letters as part of the username and not the numbers.

Related References

• Password complexity requirements