fix priority mismatch when adding new mfa policy, leading to update error

examples/resources/okta_policy_mfa_default/priority.tf

@@ -0,0 +1,21 @@
+resource "okta_factor" "okta_email" {
+  provider_id = "okta_email"
+}
+
+resource "okta_factor" "okta_password" {
+  provider_id = "okta_password"
+}
+
+resource "okta_policy_mfa_default" "test" {
+  is_oie = true
+
+  okta_password = {
+    enroll = "REQUIRED"
+  }
+
+  okta_email = {
+    enroll = "REQUIRED"
+  }
+
+  depends_on = [okta_factor.okta_email, okta_factor.okta_password]
+}

examples/resources/okta_policy_mfa_default/priority_updated.tf

@@ -0,0 +1,42 @@
+data "okta_group" "all" {
+  name = "Everyone"
+}
+
+resource "okta_policy_mfa" "test" {
+  name            = "testAcc_replace_with_uuid_new"
+  status          = "INACTIVE"
+  description     = "Terraform Acceptance Test MFA Policy Updated"
+  groups_included = [data.okta_group.all.id]
+
+  okta_email = {
+    enroll = "REQUIRED"
+  }
+
+  okta_password = {
+    enroll = "OPTIONAL"
+  }
+
+  depends_on = [okta_factor.okta_email, okta_factor.okta_password]
+}
+
+resource "okta_factor" "okta_email" {
+  provider_id = "okta_email"
+}
+
+resource "okta_factor" "okta_password" {
+  provider_id = "okta_password"
+}
+
+resource "okta_policy_mfa_default" "test" {
+  is_oie = true
+
+  okta_password = {
+    enroll = "REQUIRED"
+  }
+
+  okta_email = {
+    enroll = "OPTIONAL"
+  }
+
+  depends_on = [okta_factor.okta_email, okta_factor.okta_password]
+}

okta/resource_okta_policy_mfa_default.go

@@ -33,15 +33,16 @@ This resource allows you to configure default MFA Policy.
 }
 
 func resourcePolicyMfaDefaultCreateOrUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
-	id := d.Id()
-	if id == "" {
-		policy, err := setDefaultPolicy(ctx, d, m, sdk.MfaPolicyType)
-		if err != nil {
-			return diag.FromErr(err)
-		}
-		id = policy.Id
+	var id string
+	// Issue #2107, where adding a new MFA_ENROLL policy change the priority of the default policy, leading to the default policy unable to update
+	// It is now required that the default policy is set again for every create and update, and the only thing that can be change is factor/authenticator
+	policy, err := setDefaultPolicy(ctx, d, m, sdk.MfaPolicyType)
+	if err != nil {
+		return diag.FromErr(err)
 	}
-	_, _, err := getAPISupplementFromMetadata(m).UpdatePolicy(ctx, id, buildDefaultMFAPolicy(d))
+	id = policy.Id
+
+	_, _, err = getAPISupplementFromMetadata(m).UpdatePolicy(ctx, id, buildDefaultMFAPolicy(d))
 	if err != nil {
 		return diag.Errorf("failed to update default MFA policy: %v", err)
 	}

okta/resource_okta_policy_mfa_default_test.go

@@ -98,3 +98,39 @@ resource "okta_policy_mfa_default" "test" {
 		},
 	})
 }
+
+func TestAccResourceOktaDefaultMFAPolicyIssue2107(t *testing.T) {
+	mgr := newFixtureManager("resources", policyMfaDefault, t.Name())
+	config := mgr.GetFixtures("priority.tf", t)
+	updatedConfig := mgr.GetFixtures("priority_updated.tf", t)
+	resourceName := fmt.Sprintf("%s.test", policyMfaDefault)
+
+	oktaResourceTest(t, resource.TestCase{
+		PreCheck:          testAccPreCheck(t),
+		ErrorCheck:        testAccErrorChecks(t),
+		ProviderFactories: testAccProvidersFactories,
+		CheckDestroy:      nil,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					ensurePolicyExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", statusActive),
+					resource.TestCheckResourceAttr(resourceName, "priority", "1"),
+					resource.TestCheckResourceAttr(resourceName, "okta_password.enroll", "REQUIRED"),
+					resource.TestCheckResourceAttr(resourceName, "okta_email.enroll", "REQUIRED"),
+				),
+			},
+			{
+				Config: updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					ensurePolicyExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", statusActive),
+					resource.TestCheckResourceAttr(resourceName, "priority", "2"),
+					resource.TestCheckResourceAttr(resourceName, "okta_password.enroll", "REQUIRED"),
+					resource.TestCheckResourceAttr(resourceName, "okta_email.enroll", "OPTIONAL"),
+				),
+			},
+		},
+	})
+}