Set up Desktop MFA for Windows (2024)

Desktop MFA for Windows protects your computer and data by ensuring that only you can sign in to your Windows computer. Okta Verify is used to configure offline authentication methods in addition to the MFA methods that you might already be familiar with (for example, a push notification or a one-time password). After signing in to your Windows computer, you're prompted to add at least one offline sign-in method to confirm your identity. Having an offline sign-in method allows you to gain access to your computer, even without an internet connection.

Okta Verify features are based on configurations made by your organization.

Before you begin

You must have an Okta Verify account set up on your mobile device. See Set up Okta Verify on Android devices or Set up Okta Verify on iOS devices.
Ensure you have the latest version of Okta Verify:
- Okta Verify in the Google Play Store
- Okta Verify in the Apple App Store

Start this task

Start your Windows computer.
Enter your username and password.
If you don't have any offline authentication methods set up, enroll at least one method to sign in to Windows when your computer is offline. Choose one of the following methods.

Create an offline one-time password

Click One-time password.
Choose the display name, and then click Next. You can use the default name Offline one-time password or create your own.
See Also
Deploy Okta Verify to Windows devices Domänen-Passthrough-Authentifizierung an Citrix Workspace mit Okta als Identitätsanbieter Configure Desktop MFA app integration for Windows Plug-Ins verwalten | Citrix Workspace-App 2402 LTSR für Windows
On your mobile device, install the Okta Verify app.
Click Next.
On your mobile device, open Okta Verify and tap Add accountOrganizationYes, ready to scan.
Scan the QR code on your computer screen.
On your computer, click Next in the offline one-time password setup wizard. A new account appears in your Okta Verify app on your mobile device.
On your mobile device, open Okta Verify and check the number in your new account.
Enter this number in the setup wizard on your computer.
Click Finish.

You can now sign in to Windows with Offline one-time password.

Offline YubiKey

Click YubiKey.
Choose the display name, and then click Next. You can use the default name Offline YubiKey or create your own. A message confirms that the method was added. You can now sign in to Windows with Offline YubiKey.
Insert your YubiKey.
See Also
Passthrough-Zugriffsmatrix | Citrix Workspace-App 2402 LTSR für Windows
Click Next.
On your mobile device, open Okta Verify and tap Add accountOrganizationYes, ready to scan.
Scan the QR code on your computer screen.
On your computer, click Next in the offline one-time password setup wizard. A new account appears in your Okta Verify app on your mobile device.
On your mobile device, open Okta Verify and check the number in your new account.
Enter this number in the setup wizard on your computer.
Click Finish. You can now use Offline YubiKey to sign in to Windows when your computer is offline.

You can now use Offline YubiKey to sign in to Windows when your computer is offline.

Sign in to Windows with Desktop MFA

Start your Windows computer.
Enter your username and password.

Select a method to sign in. You can have one or more MFA methods:
- Okta Verify push
- Okta Verify one-time password
- Offline one-time password
- Offline YubiKey
Select Okta Verify push only if you have an internet connection.
Follow the instructions:
- For Okta Verify push, click Send push. Check your phone. Confirm the sign-in attempt in the Okta Verify app.
- For Okta Verify one-time password, open Okta Verify on your mobile device and find the one-time password. Enter the number in the sign-in field, and then click the arrow to proceed.
- For Offline one-time password, open Okta Verify on your mobile device and find the one-time password. Enter the number in the Windows sign-in field and click the arrow to proceed.
- For Offline YubiKey, insert or tap YubiKey as prompted.
You might need to authenticate with more than one sign-in method.

If authentication succeeds, you gain access to your Windows computer. The next time you sign in to your Windows computer, the last MFA method you used will be automatically selected. To choose a different authentication method, click Try another way and use the dropdown menu to select an alternate method to verify your identity.

Troubleshoot sign-in issues

If you don't set up multifactor authentication within the sign-in limit set by your administrator, you're locked out of your computer. Contact an administrator to regain access.