---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for Okta User Login Failures from Multiple IPs

# Playbook for Okta User Login Failures from Multiple IPs {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

This playbook provides systematic remediation steps to investigate incidents for user login failures on Okta.

The Okta User Login Failures from Multiple IPs playbook provides instructions on analyzing the alert when ServiceNow account failures are observed on Okta from Multiple Non-ServiceNow IPs. The alert related to this playbook checks the
Okta logs. It triggers an alert when login failure occurs for ServiceNow user IDs from more than three non-ServiceNow IP ranges in a 1-hour duration.
* **[Set up the Okta User Login Failures from Multiple IPs playbook](https://servicenow-prod.fluidtopics.net/9KpzrD~r0FJ57eK_TSzfOQ)**   
  Use the following steps to set up the Okta User Login Failures from Multiple IPs playbook.
* **[Use the Okta User Login Failures from Multiple IPs playbook](https://servicenow-prod.fluidtopics.net/rZt_BuMyzZkudSJE9beXWQ)**   
  Use this playbook to investigate security incidents for user login failures on Okta. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Okta User Login Failures from Multiple IPs playbook.