Okta Desktop MFA does not prompt users for authentication when Windows Hello is used because Windows Hello acts as an additional credential provider. Administrators must exclude Windows Hello as a credential provider using Okta registry keys to enforce Desktop MFA prompts. Users do not receive a prompt for Desktop Multi-Factor Authentication (MFA) when they log in to their Windows device using a Windows Hello PIN or Biometrics.

• Okta Identity Engine (OIE)
• Okta Device Access
• Desktop MFA
• Windows Hello

Within the Windows operating system, Windows Hello is treated as a separate credential provider rather than a single factor. As a result, it cannot be used simultaneously with Okta Desktop MFA, which itself acts as a credential provider.

What configuration excludes Windows Hello as a credential provider?

Exclude Windows Hello as a credential provider on the devices by configuring the appropriate Okta registry key to ensure Okta prompts users for Desktop MFA. 

Refer to Exclude Credential Provider from Windows Desktop MFA for detailed instructions regarding the exclusion of credential providers.