Okta Verify Push Notifications Fail on iOS Devices After Restoring From Backup

Okta Verify push notifications fail on migrated or restored iOS devices because the Apple Push Notification service (APNs) token remains bound to the old hardware identifier. Resolve this issue by resetting the Okta Verify authenticator and re-enrolling the device.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Verify
• Apple iOS

When end-users transfer data from an old Apple iPhone to a new device, iOS clones the application state and keychain data of Okta Verify. However, the secure Apple Push Notification service (APNs) push token remains bound to the physical hardware identifier of the old device on the Okta servers. Due to this mismatch, Okta attempts to send push notifications to a device signature that no longer exists, which causes notifications to fail silently on the new device.

What steps diagnose the Okta Verify push token mismatch?

Diagnose the communication link failure by updating the application and running the built-in Okta Verify diagnostic tool.

• 1. Open the App Store and update Okta Verify to the latest version.
  2. Open Okta Verify on the iOS device.
  3. Tap the Account profile.
  4. Scroll to the Troubleshooting section and tap Push Notification Diagnostics.

What do the diagnostic results indicate?

Review the diagnostic tool results to identify failures in the system notification settings, push token, notification service, or device time.

• System notification settings: Confirms iOS permissions allow notifications.
• Push token: Checks if the current device identifier matches the Okta records. A failure status indicates a migrated device.
• Notification service: Confirms connection viability to the Apple Push Notification service.
• Device time: Verifies the system clock is synchronized.

What steps allow an administrator to reset the Okta Verify account?

Reset the Okta Verify authenticator from the Okta Admin Console and instruct the end-user to re-enroll the new device.

• 1. Navigate to the Okta Admin Console.
  2. Go to Directory and select People.
  3. Select the affected user.
  4. Navigate to the Extra Verification or Security Methods tab.
  5. Locate Okta Verify and select Reset.
  6. Instruct the end-user to open Okta Verify on the iOS device, delete the old account profile, and scan the new QR code to re-enroll.

What steps allow an end-user to reset the Okta Verify account?

Remove the old Okta Verify enrollment and register the new device from the Okta End-User Dashboard using a registered backup multifactor authentication (MFA) factor.

• 1. Navigate to the Okta End-User Dashboard.
  2. Select the user name in the top-right corner and choose Settings.
  3. Confirm identity using a backup MFA
  4. Locate Okta Verify and select Remove or Set up another.
  5. Follow the on-screen prompts to register the new device.