Capability

Number challenge

What it does: A push approval needs the number shown on the sign-in screen.

WIC

In short

Number challenge asks the user to match a number shown on the sign-in screen when approving an Okta Verify push. A user who did not start the sign-in has no number to match, so a blind tap no longer approves it.¹³

Book a call How Okta does it ↓

attack types it helps against

What it is, and the attacks it stops

A plain push notification asks one question - approve or deny. A tired, distracted or rushed user can tap yes without checking if they started the sign-in.

With number challenge, the sign-in screen shows a number, and the user has to pick that same number in the push prompt on their phone. The approval then reflects what the user sees on the screen they are signing in on.¹³

NIS2 Article 21(2)(j) lists the use of multi-factor authentication or continuous authentication solutions among the cybersecurity risk-management measures, where appropriate.⁵

That small step makes attacks such as these harder:

Push fatigue (repeated approval requests)

An attacker with a stolen password triggers prompts until someone taps yes. Without the number from the sign-in screen, a tap alone does not complete the approval.

Accidental approvals

A user taps approve on a prompt they did not expect, for example while busy. The user has to pick the right number, which prompts a check that they started the sign-in.

Before and after rollout

Without

With

WithoutA user can approve a push without looking at what is on the sign-in screen.

WithThe user has to match the number from the sign-in screen, so the approval needs attention to that screen.¹³

WithoutRepeated prompts eventually get a tap, because yes is the easy answer.

WithA tap alone is not enough - the user has to pick the correct number.

WithoutEvery approval depends on the user remembering whether they started the sign-in.

WithThe prompt makes that check part of the approval - the user does not have to remember anything.

How Okta does it

Okta Verify push with number challenge is a stronger form of push MFA. Note: it still relies on the user's judgment, so it does not replace phishing-resistant factors.

The user opens a sign-in

The user signs in to an app protected by Okta and chooses Okta Verify push.³

The sign-in screen shows a number

Okta displays a number on the screen where the user is signing in.¹

The user selects the same number on the phone

The Okta Verify prompt on the phone offers several numbers, and the user taps the one shown on the sign-in screen.¹³

Policy decides what is allowed

Okta authentication policies decide which factors are accepted for each app and group. Where the risk justifies it, require phishing-resistant factors instead of push.²

WIC

Who it protectsStaff, contractors, admins

Okta VerifyOkta Verify is the app on the user's device that receives push approvals and, in addition, supports Okta FastPass.³

Number challengeOkta Verify push approvals can ask the user to select the number shown on the sign-in screen.¹³

Adaptive MFAOkta Adaptive MFA asks for stronger factors when the risk is higher.²

MFA enrollment policiesThese policies, configured in Okta, dictate which MFA factors the user must enroll in, depending on the group they are assigned.⁴

How Zelto implements it

The technology behind Okta is the ready and proven half - Zelto maps your users, devices and approval habits. Number challenge is an org-wide Okta Verify setting. We pilot by briefing admins and IT first, optionally start with "Only for high-risk sign-in attempts", then switch to "All push challenges". We start with the accounts attackers want most, and we keep a recovery path that attackers cannot talk their way into.

Typical rollout

Map who approves pushes and how
We list your apps, the factors in use and the groups that rely on push today.
Turn on number challenge for push
We configure number challenge for Okta Verify push in Okta. The setting is org-wide; we can start with "Only for high-risk sign-in attempts" before "All push challenges". For maximum protection, we also identify where phishing-resistant factors should replace push.
Pilot with admins and IT
We start with the highest-value accounts. Before wider use, we agree on an owner on your side. We also agree when to switch over and when to roll back.
Brief users and the help desk
Each group gets a short message that explains the number prompt and what to do with a request they did not start. Your help desk gets a script for the questions that follow.
Review and tighten
We review the remaining push use and exceptions on a schedule, and we reduce them as much as possible.

Pitfalls we plan for

A user gets a push they did not start.

−Users tap deny and move on, so nobody learns that someone has their password.

+Tell users to deny the request and report it, and have the security team reset the password and review the account.

Some users cannot see the number or use the phone prompt.

−Leave them on plain push or SMS, so attackers aim at them.

+Find those users in advance and give them another strong factor, such as a FIDO2 key.

Number challenge is treated as the end state.

−Stop after turning it on, although a user can still be tricked into entering a number on a phishing page.

+Use it as a step, and plan phishing-resistant factors for admins and high-risk accounts.

Users are not told what the number prompt is for.

−Roll it out silently, and users read the new screen as a fault or learn to select numbers without looking.

+Explain the prompt before the switch-over, and show users what to do when the number does not match what they see.

Want push approvals that do not get tapped blindly, without a rollout that stalls?

We review how your staff approve sign-ins today. Then we tell you what to change first.

Book a call30 minutes, no slides. We look at how your users approve sign-ins today.

Sources

Official Okta and Auth0 documentation and primary legal sources.

1Configure Okta Verify optionsOkta Help Center
2Okta Adaptive MFAokta.com product page
3Okta Verify and Okta FastPassOkta Help Center
4About MFA enrollment policiesOkta Help Center
5Directive (EU) 2022/2555 (NIS2)EUR-Lex