If the authenticator lookup returns at least one authenticator record, authentication processing requires a valid OTP to succeed, unless:
- All authenticators found are within a grace period (see Grace period).
- The user successfully requests a challenge for challenge/response (see Challenge generation).
- The user successfully requests a Virtual Mobile Authenticator OTP (see Virtual Mobile Authenticator OTP generation).