This article describes how to bypass MFA for Service Accounts on Windows desktop devices using Desktop MFA.
- Okta Identity Engine (OIE)
- Desktop MFA for Windows
To completely bypass MFA for a service account in Desktop MFA for Windows, add the account to the MFABypassList registry key. Users on this list do not need to authenticate with MFA. If a user is listed in both MFARequiredList and MFABypassList, MFABypassList takes precedence. The registry key is stored at HKLM\Software\Policies\Okta\Okta Device Access.
Registry Key Name: MFABypassList
Type: REG_MULTI_SZ
Default: Empty
Possible values for this setting:
-
Empty: MFA applies to all users.
-
username@domain.com: Separate users with a semi-colon; character.
-
GroupName: Separate group names with a semi-colon; character.
For example: john.doe@company.com;IT_Admins;Finance_Team.
