We had MFA working with MAC OTP and device registration, however recently something happened and the browser fingerprint is being created but not stored for most users, so every authentication requires MFA, which is shouldn't.  Does anyone have any suggestions where we could look for errors and what errors to look for?  I have tracing turned on and we can recreate on demand.

------------------------------
Angela Klein
------------------------------

Hi Angela, A couple of suggestions....

1. One possibility could be, Device not registered due to incomplete device finger print. What is the current setting for Advanced configuration property "allow incomplete device fingerprints to be registered"? 

2. Could be an issue with the policy itself, where device registration step is skipped for certain conditions.  You mentioned not stored for most users. Were you able to isolate for what type of users Device registration is failing? 


Finally, I would recommend to just set up a separate silent device registration policy just to test  and isolate any issues with actual device registration and runtime database.


Hope you get some clues...



Regards,
Rama

------------------------------
Rama Yenumula
------------------------------