Configure your Okta org for MFA Credential Provider for Windows

Before you install the Okta MFA Credential Provider for Windows, you must complete the following tasks in your Okta org:

  • Define a group for the users allowed to access the Windows Server using RDP.
  • Enable the MFA authenticators to use for RDP sign-in.
  • Add and configure the Microsoft RDP (MFA) app.
  1. Define groups to use for authentication:

    1. In the Admin Console, go to DirectoryGroups.

    2. Click Add Group.
    3. Complete the fields and then click Save.
    4. Add people to the group. See User management.
  2. Enable MFA:

    1. In the Admin Console, go to SecurityAuthenticators.

    2. Click Add authenticator.
    3. Click Add on the authenticator that you want to add. At a minimum, add Okta Verify.
    4. Configure the authenticator, and then click Add.
    5. In the Actions menu, choose Edit to configure more settings.
  3. Configure MFA enrollment:

    1. In the Admin Console, go to SecurityAuthenticators.

    2. Select the Enrollment tab.
    3. Click Add Multifactor Policy.
    4. Enter a policy name and description.
    5. In the Assign to groups field, enter the name of the group for the users allowed to access the Windows Server using RDP.
    6. In the Effective factors section, select Required for each required authenticator.
    7. Click Create Policy.
    8. Click Add Rule, and then configure it.
  4. Add and configure the Microsoft RDP (MFA) app:

    1. In the Admin Console, go to ApplicationsApplications.

    2. Click Browse App Catalog.
    3. Search for and select Microsoft RDP (MFA), and then click Add Integration.
    4. Click Add on the Microsoft RDP (MFA) app.
    5. Enter a name for the app and then click Next. RDP may fail if the name of the RDP agent that the user connects to doesn't match the Microsoft RDP (MFA) App name.
    6. Select the Assignments tab.
    7. Assign the application to groups or individuals.
    8. Save your changes.
    9. Select the Sign On tab.
    10. Click Add Rule and add any required sign-on rules.
    11. Click Done when complete.