Okta MFA Factor Deactivated or Reset

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•0•23

This rule detects when a Multi-Factor Authentication (MFA) factor is deactivated or all MFA factors are reset for a user within Okta. This activity can indicate an adversary attempting to bypass or disable MFA to gain persistent access to an account.