Employees sign in to Windows with Okta Verify and then open Okta-connected apps without signing in again. Use it when your company runs on Okta and you want stronger sign-in on Windows devices.

Feature/Functionality

Overview

This control is for Windows only:

Setting it up takes work on both sides: in the Okta Admin Console and in Factorial IT. Follow the steps in order.

How to use

Step 1: Create the Desktop MFA app in Okta

1. In Okta, go to Admin Console > Applications > Applications > Browse App Catalog.
2. Find Desktop MFA for Windows and click Add integration.
3. Open the app and go to the General tab.
4. Copy the Client ID and the Client Secret. You need both in Step 4.

If the integration is not available, talk to your Okta Account Manager: Okta Device Access is a paid add-on. If you have already set up Mac login with Okta, it is already on.

Step 2: Turn on Okta Verify enrolment

1. Go to Admin Console > Security > Authenticators and check that Okta Verify is active.
2. Under Security > Authenticator enrollment, make sure every employee in scope must enrol in Okta Verify.

Step 3: Deploy Okta Verify for Windows

In the software library, add Okta Verify for Windows to the profile that targets your Windows devices.

Do this before Step 4. If the login screen settings arrive before Okta Verify is installed, the Windows login breaks.

Step 4: Deploy the Okta ADMX settings with the CSP Builder

1. Open the CSP Builder.
2. Load the Okta Device Access ADMX template. Until it is offered directly in the CSP Builder, download OktaODA.admx and OktaODA.adml from Okta's article on Group Policy templates for Desktop MFA for Windows and upload them by hand.
3. Fill in these settings:

• OrgUrl: your Okta domain, for example yourorganization.okta.com.
• ClientId: from the Desktop MFA app.
• ClientSecret: from the Desktop MFA app.

4. Export the CSP policy it generates and apply it to the profile that targets your Windows devices.

Step 5: Turn on Device-Bound SSO in Okta

Device-Bound SSO turns the Desktop MFA login into a lasting Okta session, so employees reach Okta-connected apps without a second sign-in.

It needs Okta Verify 6.6.2 or later. Update Okta Verify on the devices first: on older versions, the Device-Bound SSO registry settings can lock employees out of Windows.

1. Go to Admin Console > Settings > Feature Manager and turn on Device-Bound Single Sign-On (Early Access).
2. Open Security > Device integrations and go to the Device Access tab.
3. Add a Static SCEP certificate authority and copy the SCEP URL and the SCEP challenge.

Step 6: Deploy the SCEP certificate

Create a SCEP certificate profile and deploy it to your Windows devices. Apply it at Computer level, not at User level.

Step 7: Set the authentication policies in Okta

1. Go to Admin Console > Security > Authentication Policies.
2. Open or create a policy for the Okta-connected apps you want to protect.
3. Add a rule for registered, Okta-joined devices:

• Set Device State to Registered.
• Add the expression device.provider.deviceAccess.joined == true.

4. Set the rule to grant access through the device session.

What happens on the device

The ADMX settings install a Windows Credential Provider. When an employee locks or wakes the device, Okta Verify takes over the login screen. The employee confirms with Okta Verify (a push notification, a one-time code or a FIDO2 key) and Windows unlocks.

With Device-Bound SSO on, Okta creates a session at login that is tied to the device's secure hardware. When the employee opens an Okta-connected app, Okta checks that session against the app's authentication policy. If the device is Okta-joined and meets the required assurance level, access is granted with no extra prompt.

Troubleshooting and FAQ

Troubleshooting

• Desktop MFA for Windows is missing from the Okta catalogue. Okta Device Access is a paid add-on. Ask your Okta Account Manager to turn it on.
• The Windows login screen stopped working after deployment. The ADMX settings probably arrived before Okta Verify was installed. Make sure Okta Verify for Windows is deployed first.
• Employees are locked out after turning on Device-Bound SSO. Check the Okta Verify version on the device. It must be 6.6.2 or later.
• Employees are still asked to sign in to Okta apps. Check the authentication policy rule: Device State set to Registered, the device.provider.deviceAccess.joined == true expression, and access granted through the device session.

FAQ

1. Which ways can employees confirm their login?
   With Okta Verify: a push notification, a one-time code (TOTP) or a FIDO2 key.
    
2. Do I need Device-Bound SSO?
   Only if you want employees to open Okta-connected apps without signing in again. The Windows login works without it.
    
3. I already set up Mac login with Okta. Do I need to buy anything else?
   No. Okta Device Access is already on for your organisation.