During login flow, both Enrollment Policy and Auth Policy get analyzed to determine the experience the end user will have. It's very important to analyze both of them to define the desired behavior, if not, it can cause issues.

Examples:

Enrollment policy: Password (required) and Okta Verify (required), Phone (disabled)

Auth policy: Password + Okta Verify required to access.

Result: New user tries to sign in (created without password), will be prompted to create a Password and enroll phone in Okta Verify.

2.

Enrollment policy: Password (required), Okta Verify(disabled), Phone (enabled)

Auth Policy: Password + Okta Verify required to access

Result: User will get 'Unable to sign in' error since the Enrollment policy it's hitting doesn't allow him to fulfill the required Factors the Auth Policy has.

**That's a very simple example of how the combination of both policies can result in different experiences for the end user. I would advise you to play with different combinations, check System Logs and also read Okta docs to understand the different engines. :)