# Detect and Suspend Accounts Based on Suspicious Events (Workflows template) **URL:** \ **Category:** Templates\ **Created:** [February 16, 2026, 5:06pm UTC](https://devforum.okta.com/t/detect-and-suspend-accounts-based-on-suspicious-events-workflows-template/35057 "2026-02-16T17:06:39Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![vasilis.caraman](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vasilis.caraman/32/6452_2.png) [@vasilis.caraman](https://devforum.okta.com/u/vasilis.caraman)\ **Post date:** [February 16, 2026, 5:06pm UTC](https://devforum.okta.com/t/detect-and-suspend-accounts-based-on-suspicious-events-workflows-template/35057/1 "2026-02-16T17:06:39Z")
# **Detect and Suspend Accounts Based on Suspicious Events** **File:** - [detect-and-suspend-accounts-based-on-suspicious-events.folder](https://devforum.okta.com/uploads/short-url/fxVOz5Y5ecicKEK5QhRP1XYWveT.folder) (278.6 KB) ## **Overview** Automatically detects and suspends potentially compromised accounts by monitoring for three suspicious events occurring within a one-hour window: MFA factor updates, password resets, and logins from new IP addresses. When all three events are detected within 60 minutes for the same user, the workflow automatically suspends the account and removes the tracking entry. ## **Prerequisites** ### **Okta** - Okta tenant with Workflows enabled - Permissions to create Event Hooks - Permissions to suspend users - Okta Workflows OAuth app with required scopes: ## **Business Use Case** When an account is compromised, attackers typically follow a pattern: 1. **Reset the password** to lock out the legitimate user 2. **Update MFA factors** to maintain persistent access 3. **Login from a new IP address** (different geographic location) This workflow detects this attack pattern in real-time and automatically suspends the account before significant damage occurs, allowing security teams to investigate. ### **Key Features** - **Single flow architecture** - Economical design with one flow and one table - **Automatic time-window tracking** - Uses 1-hour sliding window - **New user exclusion** - Ignores accounts less than 7 days old (reduces false positives) - **Dual format support** - Handles both New IP detection formats from Okta - **Self-cleaning** - Automatically manages table entries ## **Architecture** The workflow uses a single API Endpoint trigger card, hit by three Event Hooks. When any of the three monitored events occurs, the flow determines which event type it was, checks the tracking table, calculates the time window, and takes appropriate action based on whether all three events have occurred within one hour. **Flow chart:** ![detect-and-suspend-accounts-based-on-suspicious-events-chart](https://global.discourse-cdn.com/oktadev/original/2X/e/e534a1dcd73baa44c71deab7ca725dcc3b1bc48b.png) ## **Setup Steps** ### **Step 1: Import the Workflow** 1. Download the `workflow.folder` file 2. In Okta Workflows console, click **Flows** 3. Click the **three-dot menu** (⋮) in any folder 4. Select **Import** 5. Choose the downloaded `.folder` file 6. Click **Import** The workflow and table are now imported with all configurations. ### **Step 2: Configure Okta Connection (If not already configured)** The workflow requires an Okta connection with specific scopes: 1. Go to **Okta Admin Console** → **Applications** → **Applications** 2. Find **Okta Workflows OAuth** (created automatically when Workflows is enabled) 3. Click on the application 4. Go to **Okta API Scopes** tab 5. Ensure these scopes are granted: 6. In **Workflows console** → **Connections** 7. Verify the **Okta** connection is active and working ### **Step 3: Configure the API Endpoint** 1. Open the imported flow 2. Click on the **API Endpoint** card (first card in the flow) 3. Note the **Invoke URL** (you’ll need this for Event Hooks) 4. Configure security: ### **Step 4: Create Event Hooks** Create three Event Hooks in Okta Admin Console, all pointing to the same API Endpoint. #### **Event Hook 1: MFA Factor Update** 1. Go to **Workflow** → **Event Hooks** in Okta Admin Console 2. Click **Create Event Hook** 3. Configure: 4. Click **Save & Continue** 5. Click **Verify** to test the connection (if required) #### **Event Hook 2: Password Reset** Repeat the above process with: - **Name:** `Suspicious Activity - Password Reset` - **URL:** [Same API Endpoint URL] - **Authentication:** [Same credentials] - **Subscribe to Events:** Select `user.account.reset_password` #### **Event Hook 3: New IP Detection** Repeat the above process with: - **Name:** `Suspicious Activity - New IP` - **URL:** [Same API Endpoint URL] - **Authentication:** [Same credentials] - **Subscribe to Events:** Select `user.session.start` ### **Step 5: Activate the Workflow** 1. In Workflows console, open the imported flow 2. Review all connections are valid (green checkmarks) 3. Click **Turn Flow On** (toggle in top-right) The workflow is now active and monitoring events. ## **How It Works** ### **Event Processing Flow** 1. **Event Hook triggers** - One of three events occurs in Okta 2. **API Endpoint receives event** - Flow determines which event type 3. **User validation** - Checks if user is older than 7 days (skips new accounts) 4. **Table lookup** - Checks if user already has a tracking entry 5. **Time calculation** - Determines hours since last event for this user 6. **Branch logic:** ### **New IP Detection Handling** Okta sends New IP information in two possible formatsc (json and string). The workflow handles both automatically. ### **New User Exclusion** Users created less than 7 days ago are excluded from monitoring. This prevents false positives during legitimate onboarding activities where users naturally set up MFA for the first time, reset temporary passwords, and login from new locations. ## **Testing the Workflow** ### **Test Individual Events** Event Hooks can be tested directly from Okta Admin: 1. Go to **Workflow** → **Event Hooks** 2. Select an Event Hook 3. Click **Preview** tab 4. Click **Deliver Request** 5. Check the Workflows Table to verify entry was created/updated ### **Test Full Scenario** To verify complete functionality: 1. Create a test user (either have a test user older than 7 days or remove the “Continue If” card that skips new users temporarily) 2. Within 1 hour, trigger all 3 events: 3. Verify the user is suspended in Okta 4. Verify the table entry for that user is deleted **Important:** Always test with non-production user accounts. ## **Limitations & Considerations** - **1-hour window is fixed** - Modifying the time threshold requires flow changes - **New users excluded** - Accounts less than 7 days old are not monitored - **Manual Event Hook setup** - Event Hooks must be created and configured manually ( **event types** : `user.mfa.factor.update`, `user.account.reset_password`, `user.session.start`) - **Single table cleanup** - Table entries persist for users with incomplete event sets (by design for continued tracking) ## **Troubleshooting** ### **Workflow Not Triggering** - Verify all three Event Hooks are **Active** in Okta Admin - Check Event Hook **Verification Status** is successful - Ensure API Endpoint invoke URL matches exactly in all three hooks - Verify authentication credentials (Client Secret) match between flow and hooks (if used) ### **User Not Suspended** - Check Okta connection has required scopes: okta.users.read and okta.users.manage - Verify the flow is **turned on** - Check user is older than 7 days - Review Workflows execution history for errors ### **Table Not Updating** - Verify the Workflows Table was imported successfully - Check table has correct column names ## **Extension ideas:** This workflow can be extended to: - **Add notifications:** Send Slack/email alerts when users are suspended by this workflow - **Adjust time window:** Modify the 1-hour threshold to suit your security requirements - **Add more events:** Monitor additional suspicious behaviors - **Whitelist users:** Exclude specific users/groups from monitoring