Okta Workflows GET Call for Factors API Displays Different Results for MFA Enrollments

When a workflow calls the Factors API, the response displays different Multi-Factor Authentication (MFA) enrollments compared to an API client like Postman because the Factors API evaluates MFA enrollment policies based on the client IP address. Using the authenticator-enrollments endpoint and granting the necessary scopes in the Okta Workflows OAuth application resolves this discrepancy. Specifically, a workflow calling /api/v1/users/<userID>/factors does not present all of the MFA enrollments for that user, whereas the same API call in Postman yields different results.

• Okta Identity Engine (OIE)
• Okta Workflows
• Factors API
• API clients (such as Postman)

The Factors API evaluates requests against MFA enrollment policies. Conditions such as a disabled MFA factor in an enrollment policy or a specific network zone condition generate different results. The client IP address of Okta Workflows differs from the IP address of Postman, which triggers the evaluation of a different MFA enrollment policy if a network zone is configured.

How are all authenticator enrollments retrieved in Okta Workflows?

Retrieve all authenticator enrollments by calling the authenticator-enrollments endpoint and configuring the Okta Workflows OAuth application with the required custom scopes.

1. Call the authenticator-enrollments endpoint instead of the Factors endpoint. NOTE: This endpoint is for Okta Identity Engine (OIE) organizations only. Okta Classic Engine organizations must continue using the Factors endpoint.

2. Re-authorize the Okta connection in the Okta Workflows OAuth application.
3. Switch the permissions from DEFAULT to CUSTOM.
4. Add the okta.authenticators.manage, okta.authenticators.manage.self, and okta.authenticators.read scopes manually.
5. Contact Okta Support if the API call still fails to present all MFA enrollments for the user.