Agentless Desktop Single Sign-on (ADSSO) fails and prompts users with a "Windows authentication" pop-up when the web browser has an incorrect configuration or runs in incognito mode. Resolving this issue requires configuring the browser settings to trust the Okta domain and ensuring incognito mode is not being used. 

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory
• Agentless Desktop Single Sign-On (ADSSO)

The web browser either lacks the proper configuration to automatically pass Windows credentials to Okta, or it operates in incognito or private browsing mode, which blocks the seamless authentication process.

How are Windows Internet Options configured for Okta Agentless Desktop Single Sign-On?

Configure the Windows operating system Local Intranet Zone settings to enable integrated Kerberos authentication for browsers by adding the Okta Kerberos URL.

1. Open the Control Panel on the Windows machine.
2. Select Network and Internet, and then choose Internet Options.
3. Go to the Security tab.
4. Select Local Intranet, and then choose Sites.
5. Select Advanced.
6. Enter the unique Okta Kerberos URL for the organization (for example, https://<myorg>.kerberos.okta.com).
7. Select Close, and then select OK on all remaining windows.

Browser-specific configurations and enterprise deployment methods ensure seamless authentication.

Review the following browser-specific requirements and enterprise deployment options to ensure the authentication settings apply correctly across the environment.

• Microsoft Edge and Google Chrome: These browsers automatically inherit settings from the Windows Local Intranet Zone when configured correctly. For enterprise environments, manage policies via Group Policy Object (GPO) to enforce authentication allowlists (AuthServerAllowList) if default intranet inheritance is restricted.
• Mozilla Firefox: Firefox handles integrated authentication via internal settings. Ensure the network.negotiate-auth.trusted-uris preference in the about:config menu includes the Kerberos URL (.kerberos.okta.com) if the browser does not automatically respect the Windows system intranet zone.
• Enterprise Deployment: Use a Group Policy Object (GPO) or Mobile Device Management (MDM) to automatically push the Local Intranet Zone settings and security configurations to all domain-joined client machines.

Related References

• Configure browsers for Windows agentless Desktop Single Sign-on