Our Okta is setup so that it usually does the two-factor before asking for password.