There are two fail over options:
- Okta automatically fails over to the default sign-on page or the custom error URL if it is available.
- You can use on-prem IWA DSSO as a backup.
Choosing to fail over to on-prem IWA DSSO, requires you to install and configure the on-prem IWA DSSO. If on-prem IWA DSSO is configured and enabled, it will automatically take over if Agentless DSSO stops working. See Install and configure the Okta IWA Web agent for Desktop Single Sign-on.