Migrate from Integrated Windows Authentication to agentless Desktop Single Sign-on

To simplify user access management, Okta encourages you to move from Integrated Windows Authentication (IWA) to agentless Desktop Single Sign-on (ADSSO). Okta is no longer adding new IWA functionality and offers only limited support and bug fixes.

  1. Configure agentless Desktop Single Sign-on

  2. Set IWA as a failover option for ADSSO. See Configure failover for the Okta IWA Web agent.

  3. Test your ADSSO configuration. See Test the agentless Desktop Single Sign-on configuration.

  4. Make ADSSO active:

    1. In the Admin Console, go to Security > Delegated Authentication.

    2. Scroll to Agentless Desktop SSO and Silent Activation.

    3. Click Edit and select On.

    4. Scroll down and click Save.

  5. Disable the Okta IWA agent:

    1. In the Admin Console, go to Security > Delegated Authentication.

    2. Scroll to On-Prem Desktop SSO.

    3. Click Edit and select Off.

    4. Scroll down and click Save.

  6. Optional. Delete the Okta IWA agent:

    1. In the Admin Console, go to Security > Delegated Authentication.

    2. Scroll to On-Prem Desktop SSO.

    3. Click Edit and scroll to the IWA Agents section.

    4. Click Delete and Delete Agent in the Delete IWA Agent dialog.

    5. Optional. Repeat step d to delete additional Okta IWA agents.