OneLogin - Smart MFA Alerts during Initial Learning Phase (4383262)

High‑risk security alerts are triggered during normal login activity, including valid logins from different locations.Alerts are generated even when multi‑factor authentication (MFA) is successfully completed.Large volumes of alerts and events are produced, especially for new or highly variable user populations.MFA is requested on every login attempt when a minimal tolerance setting is applied.Risk scores remain high despite expected or legitimate login behavior.

ONELOGIN Smart MFA uses Vigilance AI to evaluate login behavior based on factors such as location, IP address, device, and browser.Vigilance AI assigns risk scores independently of MFA tolerance settings, using a fixed scoring model.New users or environments without established behavior patterns result in increased risk scores because no baseline exists.

 

Highly variable behavior, such as frequent location changes, is interpreted as unusual and produces high‑risk classifications.During the initial learning phase, which can last several weeks, the system continues to generate elevated risk scores and alerts.

The system reaches a stable state once Vigilance AI completes its learning phase and builds a consistent behavioral profile for each user. As behavior patterns become established, the frequency of high‑risk alerts naturally decreases. MFA enforcement continues according to the configured tolerance level, where minimal tolerance results in strict and consistent MFA prompts. 

 

Risk scoring remains unchanged by tolerance settings, ensuring that behavioral analysis continues to produce event data even after stabilization.Over time, the system differentiates between typical and atypical behavior, reducing unnecessary alerts while maintaining security evaluation.