Configure offline biometrics for Windows

Configure offline biometrics so your users can sign in to their Windows machines using Windows Hello factors (fingerprint or face) and Okta Device Access.

Before you begin

  • Ensure that you have administrative access to the Mobile Device Management (MDM) solution used to manage your Windows devices.
  • Verify that user devices are equipped with Windows Hello-compatible hardware (fingerprint reader or IR camera).
  • Instruct users that they must first enroll in Windows Hello on their local machine before they can use this feature.
  1. Open the policy configuration editor for your MDM solution.
  2. Create a policy or edit an existing policy that targets the desired group of Windows devices.
  3. Add the following registry keys to the policy. All keys are in the Windows registry under: HKLM\Software\Policies\Okta\Okta Device Access.
    Table 1. Offline biometrics registry keys
    Registry Key Type Value
    PasswordlessAccessEnabled REG_DWORD 1
    AllowedFactors REG_MULTI_SZ
    • Offline_Fingerprint
    • Offline_FaceBio
    PrioritizeBiometrics REG_DWORD 1

    See Configure and deploy Desktop MFA policies for Windows.

  4. Save and deploy the policy to the targeted devices.

After you apply the policy to the device, then the next time a user signs in with their password, Okta Verify prompts them to register their enrolled Windows Hello biometrics for offline use. For future sign-in flows, the Windows credential provider prompts the user for their face or fingerprint instead of a password.