diff --git a/detections/experimental/application/okta_large_mfa_attempts.yml b/detections/experimental/application/okta_large_mfa_attempts.yml
index 70c5e3737d..2732872c52 100644
--- a/detections/experimental/application/okta_large_mfa_attempts.yml
+++ b/detections/experimental/application/okta_large_mfa_attempts.yml
@@ -10,8 +10,6 @@ description: The following analytic identifies an account that has rejected more
 search: '`okta` eventType=user.authentication.auth_via_mfa | bin span=10m _time
 | stats count as mfa_attempts by src_user, _time | eventstats avg(mfa_attempts) as average_attempts
 | apply escu_okta_mfa_attempts_v1 upper_threshold=0.001 | rename IsOutlier(mfa_attempts) as outlier | where outlier=1
-| lookup ignore_list_okta_mfa_attempts src_user as src_user outputnew ignore
-| where isnull(ignore)
 | eval upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
 | `security_content_ctime(_time)`
 | table _time, src_user, mfa_attempts, average_attempts, upper_threshold