Okta must enforce 24 hours/one day as the minimum password lifetime.

Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement.

Restricting this setting limits the user's ability to change their password. Passwords must be changed at specific policy-based intervals; however, if the application allows the user to immediately and continually change their password, it could be changed repeatedly in a short period of time to defeat the organization's policy regarding password reuse.

Satisfies: SRG-APP-000173, SRG-APP-000870

From the Admin Console: 1. Select Security >> Authenticators. 2. Click the "Actions" button next to the "Password" row and select "Edit". 3. For each listed policy, verify "Minimum password age is XX hours" is set to at least "24".

For each policy, if "Minimum password age is XX hours" is not set to at least "24", this is a finding.

From the Admin Console: 1. Select Security >> Authenticators. 2. Click the "Actions" button next to the "Password" row and select "Edit". 3. For each listed policy: - Click "Edit". - Set "Minimum password age is XX hours" to at least "24".