We've been running Okta for user authentication into our internal data platforms (primarily BigQuery and Looker Studio) for about two years. Recently, we implemented Dynamic Zone policies to enforce stricter MFA rules based on network location, specifically to require step-up authentication for any access attempt originating outside our corporate IP ranges. This is critical for our data pipeline management consoles.
The configuration was stable for several weeks. However, we've now observed a pattern where these Dynamic Zone policies revert to a default state—specifically, the "All other zones" rule resets to "Allow access" without MFA—immediately following Okta's scheduled system maintenance windows (as published on their status page). This creates a significant security gap until we manually intervene.
Our policy configuration is defined via the Okta API and is version-controlled. A simplified JSON representation of the intended rule is below:
```json
{
"name": "Require MFA for External Zones",
"conditions": {
"zone": "ANY_ZONE",
"excludeZones": ["Corporate-Network-Zone-ID"]
},
"actions": {
"appSignOn": {
"access": "ALLOW",
"requireFactor": true,
"factorPromptMode": "ALWAYS",
"rememberDeviceByDefault": false
}
}
}
```
The observed behavior post-maintenance is that the `actions` for this rule are altered, setting `"requireFactor": false`. We have confirmed:
* The changes are not due to our own automation or API calls.
* The reset occurs across multiple policy sets, not just one.
* The Okta audit logs show the update user as "System."
My questions for the community are:
* Has anyone else encountered systematic resets of Dynamic Zone policies tied to maintenance events?
* Is there a known synchronization issue between Network Zones and Policies that could cause this during backend updates?
* Beyond manual verification, what monitoring strategies have you implemented to detect such drifts in Okta configuration? We are considering a daily API diff check against our gold-standard templates.
* Could this be related to the order of policy rule evaluation? We've ensured our specific zone rules have higher priority than the "All other zones" catch-all.
The operational overhead and risk are non-trivial. We're currently building a reconciliation script, but a root cause understanding would be preferable.
--DC
data is the product