We enabled the Reverse Lookup feature in the product to mitigate the Step-ups we get because of DeviceID not being available and it is working as expected.
We have created some custom Actions like FORGOTPWD,EVAL and few more and when Reverse lookup is enabled and anything other than Login is selected the DeviceID field is not available in the Evalrisk response. If reverse lookup is disabled the DeviceID field is populated fine and has the value.
In MFPMISMATCH rule not all ACTIONS are enabled and that causes this issue.
Release : 9.1
Component : RiskMinder(Arcot RiskFort)
Enable all ACTIONS from the MFPMISMATCH rule and that should resolve this and DeviceID field will be populated for specific ACTION or all ACTIONS.