Starting with Chrome version 142 the browser requires permission for the Okta sign-in page to communicate with a secure loopback server on the device during Okta FastPass authentication. Administrators can suppress this Local Network Access prompt by configuring Chrome enterprise policies via Google Workspace or a Mobile Device Management solution. Without this configuration, users experience an unexpected permission prompt when Okta FastPass attempts to verify their identity.

• Okta Identity Engine (OIE)
• Okta FastPass
• Google Chrome
• Windows
• macOS
• iOS
• Android

How is the Local Network Access prompt suppressed?

Okta recommends notifying users that the Local Network Access prompt is safe and expected. To deliver a seamless sign-in experience on Android, macOS, and Windows, pre-grant the permission for the Okta sign-in origins using the Local Network Access enterprise policy for Managed Chrome Profiles. Chrome on iOS does not prompt for Local Network Access, requiring no configuration.

What are the required Chrome policy configurations?

Administrators must configure specific Chrome policies to prevent the prompt when Okta FastPass communicates with the local loopback service on localhost or 127.0.0.1.

• LocalNetworkAccessAllowedForUrls: Add the requesting page origins (the Okta sign-in host) so they may call the local endpoint without a prompt.
  NOTE: Allowlist the origin making the request (for example, `https://<subdomain>.okta.com` or the custom Okta domain), not the local endpoint.

• LocalNetworkAccessRestrictionsEnabled: Ensures the browser consistently enforces Local Network Access so that the allowlist takes effect.
• LoopbackNetworkAllowedForUrls: In Chrome 146 and later, the Local Network Access permission splits into Local Network and Loopback Network. Okta FastPass utilizes the Loopback Network permission.
  NOTE: Administrators who already configured the legacy permission require no immediate action, but Okta encourages transitioning to the Loopback Network permission as users upgrade to Chrome 146 or later.

Configure Chrome browser using Google Workspace

Blocking the prompt in Google Workspace provides both enrolled and bring-your-own devices with a path to a seamless Okta FastPass experience. Assign Managed Profiles to the users with Okta and Google Workspace.

Configure the Local Network Access restrictions in the Google Admin Console by following these steps.

1. Navigate to Chrome Browser and select Settings in the Workspace admin console.
2. Locate the Local Network Access restrictions setting.
    
3. Configure the setting so that Inheritance is Locally applied.
4. Set the Configuration option to Apply restrictions to requests to Local Network Access.
5. Add a URL pattern for each domain to be included in the allowlist.
    
6. Assign the setting to the desired Organizational Unit and hit Save.
7. Open chrome://policy in the test browser, then click Reload to confirm that the values are applied.

How is the Chrome browser configured using a Mobile Device Management solution?

Use a Mobile Device Management (MDM) solution to deploy a policy that pre-grants permission for the Okta sign-in URLs on managed devices.

Configure the policy for Windows devices via Intune by following these steps.

1. Navigate to Devices > Windows > Configuration in the Intune console.
2. Select Create and choose New Policy
3. Select Windows 10 and later for the profile and Settings catalog for the profile type.
4. Select Add settings in the Configuration settings.
5. Locate Google Chrome Local Network Access settings and select Allow sites to make requests to local network endpoint.
6. Select Enable, then enter the Okta organization URL and any custom URLs.

Deploy a configuration profile with a custom Chrome payload for macOS devices managed by an MDM by applying this XML snippet.

XML

<key>LocalNetworkAccessAllowedForUrls</key>
<array>
    <string>https://atko.okta.com</string>
    <string>https://[*.]okta.com</string>
    <string>https://login.companydomain.com</string>
    <string>https://[*.]companydomain.com</string>
</array>
<key>LocalNetworkAccessRestrictionsEnabled</key>
<true/>

Push the policy for managed Android devices using the MDM managed application configuration capabilities for the Google Chrome application by applying this JSON block.

JSON

{
  "LocalNetworkAccessAllowedForUrls": [
    "https://atko.okta.com",
    "https://[*.]okta.com",
    "https://login.companydomain.com",
    "https://[*.]companydomain.com"
  ],
  "LocalNetworkAccessRestrictionsEnabled": true
}

Configure the policies via the Windows Registry

How is the configuration tested?

Verify the applied policies and test the Okta FastPass authentication by following these steps.

1. Open a browser where the system assigned the settings.
2. Enter chrome://policy in the search bar and verify the policy has been applied to the browser.
3. Locate the LocalNetworkAccessAllowedForUrls policy and verify that the Okta URLs appear.
4. Enter chrome://flags in the search bar.
5. Find the Local Network Access Checks setting and configure it to Enabled. 
6. Sign in with FastPass.

Frequently Asked Questions about the Local Network Access prompt

Is this a security risk? Will Okta access other devices?

This is not a security or privacy risk. Okta uses the local network connection only to communicate with Okta Verify on the device used to sign in. Okta does not read any other information or connect to any other devices on the network.
 

How many times does the prompt appear?

Users must select the Allow button only once per device. After this initial authorization, the browser suppresses the prompt for all future sessions on that device.
 

What happens when a mobile device is used?

This prompt also appears on mobile devices. Administrators can pre-approve this setting for managed Android devices. Otherwise, users must accept the prompt on their first Okta FastPass use.
 

What happens if a user accidentally blocks the permission?

Users can reset the permission directly in the Chrome site settings for the Okta domain.

Reset the blocked permission in Chrome by following these steps.

1. Select the padlock or tune icon on the left side of the address bar while on the Okta sign-in page to open the site settings menu.
2. Find the Local network access setting.
3. Use the toggle to change the permission from Block back to Allow.
4. Reload the page.

Does access need to be enabled for other Chromium-based browsers?

Yes, browsers based on Chrome 142 or above require access to the local network for Okta FastPass. Administrators can apply these steps to other browsers, but the registry location differs. For example, the Microsoft Edge policy path is  SOFTWARE\Policies\Microsoft\Edge.

Related References

• New permission prompt for Local Network Access
• Chrome Enterprise and Education release notes
• LocalNetworkAccessAllowedForUrls
• LocalNetworkAccessRestrictionsEnabled
• LoopbackNetworkAllowedForUrls
• Set Chrome policies using the Custom Configurations page
• Microsoft Edge LocalNetworkAccessAllowedForUrls