Create a network zone for IWA sign-ins

You can create a network zone for Integrated Windows Authentication (IWA) sign-ins.

Okta evaluates IWA sign-ins and verifies that they come from a configured zone. When an IWA agent is configured, the IP address of the client is added to the LegacyIPZone. The LegacyIPZone is the only zone configured by default. You can define up to 20 dynamic zones in IWA Network Zones.

• Configure a LegacyIPZone routing rule
• Define a network zone for LegacyIPZone

Before you begin

Ensure that IWA Web agent is installed and configured.

Configure a LegacyIPZone routing rule

1. In the Admin Console, go to SecurityIdentity ProvidersRouting Rules.

2. Click Add Routing Rule.
3. Complete these fields:
   • Rule Name: Enter a descriptive name for the rule.
   • User's IP is: Select In zone to apply the rule to a specific zone.
   • In the zones field, type "l" (lower-case "L") and then select LegacyIpZone.
   • User's device platform is: Select Any device to apply the rule to users with any device type. To apply the rule to users with specific devices, select Any of these devices and select specific devices.
   • User is accessing:
     • Any application: Apply the rule when a user accesses any application.
     • Any of the following applications: Apply the rule when a user accesses specific applications. Enter an application name.
   • Use this identity provider: Select Okta.
4. Click Create Rule.
5. Click Activate.

Define a network zone for LegacyIPZone

1. In the Admin Console, go to SecurityNetworks.
2. Click Add Zone and select Add IP Zone.
3. Enter the name for the routing rule that you created in the Configure a LegacyIPZone routing rule procedure.
4. Enter the Gateway IP addresses and Proxy IP addresses. Separate IPs and IP ranges with a newline or comma. You can add single IPs, IP ranges, or use CIDR notation.
5. Click Save.

Related topics

IP zones

Network zones

Identity Providers