How to Use Multiple User Accounts with an Advanced Server Access or Okta Privileged Access Client

When attempting to enroll an Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) client with an additional user account, the process requires specific steps to avoid conflicts with the existing active session. The client automatically uses the currently logged-in account if the session remains active. Resolve this by logging out of all active sessions and using the force enrollment command to authenticate the second account.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)

How does a user enroll multiple user accounts in the client?

Log out of all active sessions, execute the force enrollment command for the specific product, and authenticate with the new account to configure multiple user profiles.

1. Log out of the Okta Advanced Server Access or Okta Privileged Access dashboard and the Okta organization.
   NOTE: If either session remains valid, Okta automatically uses the logged-in account rather than the second account intended for enrollment.
2. Enroll the client using the --force option by running the applicable command for the product:

• Okta Advanced Server Access: sft enroll --team <team-name> --force
• Okta Privileged Access: sft enroll --url https://<OrgSubDomain>.pam.okta.com --team <team-name> --force
  NOTE: The Okta Privileged Access enroll command resides in the dashboard on the Directory > Clients page. If Okta redirects to the Client Setup page immediately, the user did not fully log out of the team or Okta organization.

3. Authenticate using the second account on the Okta sign-on page.
4. Select Approve on the Client Setup page.
   NOTE: Customize the Client Name to indicate the associated username for easier identification.
5. Run the sft list-teams command in the command prompt to display the enrolled accounts. The output displays the accounts in the following format:

% sft list-teams
USERNAME        TEAM           URL                           ID                                      STATUS
asauser1        asa-team1    https://app.scaleft.com/v1    12ff4c94-b200-4690-a2c1-ab79e897605c   Expired 12h38m0s ago
asauser2        asa-team1    https://app.scaleft.com/v1    548b1ed2-add3-47fe-8c16-c7de07a9b8bc    (default) Never used

6. Switch between accounts by running the sft use <ID> command, replacing <ID> with the ID of the desired username from the previous output.
   NOTE: The username displaying "(default)" in the STATUS column indicates the account currently in use by the client.