Okta adds two-factor authentication for all single sign-on customers, strengthens security features for its cloud-based Adaptive Multi-Factor Authentication
Stephanie Condon / ZDNet :
Context & Ripple Effects
In 2017 Okta stopped treating two-factor authentication as a premium tier: every single sign-on customer now gets it by default, alongside hardened features in its cloud-based Adaptive Multi-Factor Authentication. That reframed MFA from an upsell into a baseline expectation for identity providers.
The move set up the platform arc that followed — the Sign in with Okta API extended the identity layer to third-party services, a VMware partnership aimed the combined mobile-security stack squarely at Microsoft, and by 2021 Okta had consolidated its biggest challenger via the $6.5B all-stock Auth0 acquisition. Making strong authentication free at the SSO layer was the opening bid in that land grab.
First-order effects
- Every Okta single sign-on customer gains two-factor authentication without a plan upgrade, raising the security floor across its installed base immediately.
- Adaptive Multi-Factor Authentication's strengthened cloud features give Okta's sales teams a sharper differentiator against Microsoft in enterprise identity pitches.
Second-order effects
- Rival identity providers face pressure to match bundled MFA or justify charging separately for it, compressing authentication pricing across the SSO market.
- Partners like VMware gain a stronger joint mobile-security offering to position against Microsoft's stack, deepening the alliance ecosystem forming around Okta's identity layer.
Third-order effects
- If authentication keeps collapsing into the base identity product, value migrates from point MFA vendors to platform players — the trajectory that ended with Okta absorbing Auth0 and building developer-facing identity services.
- Identity providers become the de facto control plane for enterprise security, with sign-in policy decisions concentrated in a handful of platforms rather than distributed across standalone security tools.
The trend: Enterprise identity is consolidating around platforms that bundle ever-stronger authentication into the base product, turning multi-factor auth from a paid add-on into table stakes.