Configure and deploy Desktop MFA policies

Set up Desktop MFA for macOS and create managed profiles to enable the MFA capability on your macOS computers. Use any device management (MDM) solution that supports deploying macOS installer packages and configuration profiles. These instructions assume the use of Jamf Pro for device management.

When you deploy the Desktop MFA MDM profiles, ensure that they've been successfully pushed to devices before deploying the macOS Okta Verify package. If the MDM profile doesn't exist on the user's device when the package installer runs, Desktop MFA isn't installed.

Tasks

• Upload the Okta Verify for macOS package
• Configure the installation of Desktop MFA for macOS
• Add Desktop MFA policies
• Enforce number challenge for Desktop MFA

Upload the Okta Verify for macOS package

1. Take the Okta Verify for macOS package that you downloaded from the Okta Admin Console and upload it to your MDM.

2. In Jamf Pro, go to Settings Computer management Packages.

3. Click + New to configure the package details.

Configure the installation of Desktop MFA for macOS

1. In Jamf Pro, click Computers Policies and click + New.
2. Enter a Display Name and select Login for the policy Trigger.
3. Click Packages and then click Configure.
4. Locate the Okta Verify package that you uploaded in the previous step and click Add next to the package.
5. Configure the Distribution point.
6. Using the dropdown menu, select Install as the Action.

7. Click Save.

Ensure that the MDM profile has been successfully deployed to end user devices before deploying the macOS Okta Verify package.

Add Desktop MFA policies

1. In Jamf Pro, click Configuration Profiles and then click + New.

2. Enter a name for the profile.

3. Click Application & Custom Settings to configure the payload. Click Upload.

4. Click + Add.

5. Enter com.okta.deviceaccess.servicedaemon as the Preference Domain.

6. Add the values for your organization as a plist, for example:

   Copy

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>DMFAClientID</key>
       <string>add-your-client-ID-here</string>
       <key>DMFAClientSecret</key>
       <string>add-your-client-secret-here</string>
       <key>DMFAOrgURL</key>
       <string>https://add-your-org-URL-with-prefix-here</string>
       <key>AccountLinkingMFAFactor</key>
       <string>OV_Push</string>
       <key>AdminEmail</key>
       <string>admin@yourorg.com</string>
       <key>AdminPhone</key>
       <string>111-222-3333</string>
       <key>AllowedFactors</key>
       <array>
           <string>*</string>
       </array>
       <key>DeviceRecoveryPINDuration</key>
       <real>60</real>
       <key>DeviceRecoveryValidityInDays</key>
       <real>90</real>
       <key>LoginPeriodWithoutEnrolledFactor</key>
       <real>48</real>
       <key>LoginPeriodWithOfflineFactor</key>
       <real>168</real>
       <key>MFANotRequiredList</key>
       <array/>
       <key>MFARequiredList</key>
       <array>
           <string>*</string>
       </array>
       <key>OfflineLoginAllowed</key>
       <true/>
   </dict>
   </plist>

Policy parameters

Use the following table to configure the appropriate parameters for your Desktop MFA policies.

Value name	Description	Type
AccountLinkingMFAFactor	The verification method that you want to use when linking an Okta account to the local macOS account. Available options are: OV_Push: Okta Verify push notification. This is the default value. OV_TOTP: Okta Verify Time-based one-time password	String
AdminEmail	Enter an email address for end users to get support. This value is empty by default.	String
AdminPhone	Enter a phone number for end users to get support. This value is empty by default.	String
AllowedFactors	A list of factors that users can authenticate with. The allowed factors appear in the order that they're listed in your configurations. If no factors are specified, all factors are allowed. Ensure that the factors listed are spelled correctly. Accepted values: *: All factors are allowed. This is the default value. OV_Push OV_TOTP Offline_TOTP FIDO2_USB_key	String array
DeviceRecoveryPINDuration	Valid time period for a device recovery PIN after activation. The value is in minutes. The default value is 60 minutes, with a maximum of five days (7200). See Desktop MFA recovery .	Real
DeviceRecoveryValidityInDays	Duration of the device recovery window for Desktop MFA. To successfully authenticate with a recovery PIN, the user must sign in to the device with Desktop MFA while online at least once during the specified period. For example, this value is set at 120. A user hasn't been online and hasn't signed in with Desktop MFA for over 120 days. This means that they can't use a recovery PIN even if the PIN is still valid. The user is locked out and you can't generate a recovery PIN. When the device comes back online, you can generate a recovery PIN that the user can sign in with. The value is in days. The default value is a minimum of 90 days.	Real
LoginPeriodWithoutEnrolledFactor	Specifies a grace period when a user can sign in with only a password and without enrolling any factors. Once this grace period has passed, the user must link their account and enroll an offline authentication factor to access the computer. The value is in hours. The default value is 48 hours.	Real
LoginPeriodWithOfflineFactor	If this is set to 0, a user can't sign in with offline factors. If the value of LoginPeriodWithoutEnrolledFactor is greater than 0, then users are required to sign in with an online factor every X hours. The value is in hours. The default value is 168 hours.	Real
MFANotRequiredList	Users listed in this array aren't Desktop MFA enforced. This list takes priority over the MFARequiredList array. Accounts listed here are case-sensitive. This value is empty by default.	String array
MFARequiredList	If a user is on this list and Desktop MFA is installed, the user is prompted to use MFA. However, some users with Desktop MFA installed may not be required to use MFA. If a user isn't on this list and Desktop MFA is installed, the user is only prompted for a password. For example, if the local user "john-smith" is named in the MFARequiredList array, they must use MFA. Accounts listed here are case-sensitive. The default value is *, meaning that MFA applies for all users.	String array
OfflineLoginAllowed	When this is set to true, offline factors are shown to the user. This allows the user to enroll an offline authentication factor. When this is set to false, offline factors aren't shown and there's no enforcement of offline factors. If you change this policy to true and the LoginPeriodWithoutEnrolledFactor period has expired, then users are forced to enroll an offline factor. The default value is true.	Boolean

Enforce number challenge for Desktop MFA

When Desktop MFA users sign in to their computers, they receive a number challenge with any push notification. This provides enhanced security for your org by ensuring that users can only verify their identity when their mobile device and computer are both present.

To disable the number challenge for Desktop MFA, follow these steps:

1. In the Admin Console, go to SecurityGeneral.
2. Locate the Okta Device Access section.
3. Click Edit.
4. Use the dropdown menu next to Enforce number matching challenge for Desktop MFA to select Disabled.
5. Click Save.

Next steps

Configure Desktop MFA for macOS to use FIDO2 keys

Desktop MFA recovery

Support your Desktop MFA users