diff --git a/src/D2L.Bmx/ConsolePrompter.cs b/src/D2L.Bmx/ConsolePrompter.cs
index 070301a4..5bd82dee 100644
--- a/src/D2L.Bmx/ConsolePrompter.cs
+++ b/src/D2L.Bmx/ConsolePrompter.cs
@@ -185,14 +185,14 @@ Secret input won't be masked on screen!
 				Console.Error.Write( moveLeftString + emptyString + moveLeftString );
 				passwordBuilder.Clear();
 			} else
-			// The backspace key is received as the DEL character in raw mode
-			if( ( key == '\b' || key == DEL ) && passwordBuilder.Length > 0 ) {
-				Console.Error.Write( "\b \b" );
-				passwordBuilder.Length--;
-			} else if( !char.IsControl( key ) ) {
-				Console.Error.Write( '*' );
-				passwordBuilder.Append( key );
-			}
+				// The backspace key is received as the DEL character in raw mode
+				if( ( key == '\b' || key == DEL ) && passwordBuilder.Length > 0 ) {
+					Console.Error.Write( "\b \b" );
+					passwordBuilder.Length--;
+				} else if( !char.IsControl( key ) ) {
+					Console.Error.Write( '*' );
+					passwordBuilder.Append( key );
+				}
 		}
 	}
 }
diff --git a/src/D2L.Bmx/Okta/Models/OktaSession.cs b/src/D2L.Bmx/Okta/Models/OktaSession.cs
index 876a7cc8..4f8c90d7 100644
--- a/src/D2L.Bmx/Okta/Models/OktaSession.cs
+++ b/src/D2L.Bmx/Okta/Models/OktaSession.cs
@@ -4,6 +4,7 @@ internal record OktaSession(
 	string Id,
 	string Login,
 	string UserId,
+	string Status,
 	DateTimeOffset CreatedAt,
 	DateTimeOffset ExpiresAt
 );
diff --git a/src/D2L.Bmx/OktaAuthenticator.cs b/src/D2L.Bmx/OktaAuthenticator.cs
index 9e096f52..92242a8f 100644
--- a/src/D2L.Bmx/OktaAuthenticator.cs
+++ b/src/D2L.Bmx/OktaAuthenticator.cs
@@ -137,6 +137,13 @@ string browserPath
 
 		var oktaAuthenticatedClient = oktaClientFactory.CreateAuthenticatedClient( orgUrl, sessionId );
 		var oktaSession = await oktaAuthenticatedClient.GetCurrentOktaSessionAsync();
+		if( oktaSession.Status != "ACTIVE" ) {
+			if( BmxEnvironment.IsDebug ) {
+				messageWriter.WriteWarning( "Okta passwordless authentication failed" );
+			}
+			return null;
+		}
+
 		string sessionLogin = oktaSession.Login.Split( "@" )[0];
 		string providedLogin = user.Split( "@" )[0];
 		if( !sessionLogin.Equals( providedLogin, StringComparison.OrdinalIgnoreCase ) ) {