Configure and deploy Desktop MFA policies for Windows

A configurable string that provides users with information on how to contact admins if they're locked out of their computer.

For example, Contact your Help Desk at help@org.com or call 1-800-xxx-xxxx.

List of factors that users can authenticate with.

The AllowedFactors list requires that you also enable UseDirectAuth.

Possible values for this setting:

• *: all factors are allowed. This is the same as setting this value to empty.

• OV_Push

• OV_TOTP

• Offline_TOTP

• FIDO2_USB_key

• Offline_Security_key

Ensure that the factors are spelled correctly.

Hide any custom credential provider from users by specifying the provider GUID.

Use these GUIDs to exclude the most common credential providers:

Valid time period for a device recovery PIN after activation. This period begins after the user completes a successful sign-in attempt using the PIN.

The value is in minutes. The maximum value is 7200 (five days).

See Enable Desktop MFA recovery for Windows.

Specifies the rotation frequency of the device recovery secret used to generate recovery PINs for the device.

After the period expires, this secret can't generate new PINs for the device. The secret is automatically rotated when the user's device connects to your Okta org.

If the device can't connect to your Okta org, the secret isn't rotated. You can't generate new recovery pins for the device until the user's device connects and rotates the secret.

The value is in days.

By default, the standard Windows password credential provider is disabled.

To restore and display the Windows password credential provider for users, set this value to 0.

Defines how many times users can sign in to Windows with offline MFA methods (without internet access).

This policy setting also applies when computers are online and the user authenticates with offline MFA methods.

If a user exceeds the sign-in attempts limit, access is denied. The user is prompted to connect to the internet to authenticate with an online sign-in method instead.

Defines how many times users can sign in to Windows without an MFA method.

This policy setting allows new users to postpone setting up MFA methods for the set number of times.

If Okta detects a valid online or offline MFA factor, Okta Verify prompts the user with the factor. When the user signs in with an MFA factor, this policy limit expires.

If a user exceeds the sign-in attempts limit, access is denied.

List of users or Active Directory groups that aren't required to authenticate with MFA.

If a user is listed in both MFARequiredList and MFABypassList, then the MFABypassList key takes precedence.

Possible values for this setting:

• Empty: MFA applies to all users.

• username@domain.com: Separate users with a semi-colon ; character.

• GroupName: Separate group names with a semi-colon ; character.

For example, john.doe@company.com;IT_Admins;Finance_Team

The grace period within which a user doesn't need to use MFA after locking the computer.

If you set MFAGracePeriodInMinutes to 0, then the user is prompted to verify their identity using MFA every time they sign in.

The grace period is only applicable when locking the computer. Switching user accounts or restarting the computer prompts the user to verify their identity using MFA.

The grace period doesn't apply when you enabled password autofill.

List of users or Active Directory groups that must authenticate with MFA in addition to a password.

Users must sign in to Windows at least once when the computer is online and connected to the organization's network (directly or through a VPN). This connection resolves the users' Active Directory group membership.

If users (including local users) aren't included in this list, they don't have to authenticate with MFA.

Users in this list are also eligible to sign in using password autofill. If users aren't in this list, they're required to enter a password to gain access to the desktop computer.

Possible values for this setting:

• *: MFA applies to all users.

• username@domain.com: Separate users with a semi-colon ; character.

• GroupName: Separate group names with a semi-colon ; character.

• Empty: Users don't have to use MFA to sign in to Windows

For example, john.doe@company.com;IT_Admins;Finance_Team

This value sets the network timeout to fetch a list of online MFA factors for validation.

This timeout is for network operations only and doesn't apply to user interactions. This setting is useful for users with intermittent DNS outages or other connectivity issues.

The default value is 15 seconds. The minimum value is 5 and the maximum value is 60.

This value indicates whether a user can sign in using an offline factor.

By default, the policy is set to 1 (true), meaning that users can see available offline factors.

If you set this policy to 1 and set OnlineLoginAllowed to 0 (false), then users can only see and sign in using an offline factor. This setting is appropriate for orgs that want to use offline security keys for authentication and sign-in flows.

This value indicates whether a user can sign in with an online factor.

By default, the policy is set to 1 (true), meaning that users can see available online factors.

If you set this policy to 1 and set OfflineLoginAllowed to 0 (false), then users can only see and sign in using an online factor. Offline factors aren't available.

This value enables password autofill, allowing users to sign in to their device securely using non-password factors.

By default, password autofill is disabled (0).

Password autofill supports Okta Verify Push and FIDO2 keys when you specify these as AllowedFactors.

Desktop MFA always attempts to enforce user verification through the FIDO2 key PIN. If the key doesn't have a PIN, then Desktop MFA falls back to password authentication.

This value allows users to initiate a self-service password reset if the user forgets their password.

By default, self-service password reset is disabled (0).

A configurable string to provide users with a customized error message in the event of a Self Service Password Reset failure.