Okta Verify does not satisfy the Hardware protected sign-on policy constraint when used in non-persistent environments, such as Virtual Desktop Infrastructure (VDI), ephemeral containers, or stateless virtual machines.

• Okta Identity Engine (OIE)
• Okta Verify
• Hardware Protected

Understanding the "Hardware Protected" Constraint

When configuring an app sign-on policy in Okta, administrators can enforce phishing-resistant and hardware-backed authentication by enabling the Hardware protected condition. This constraint verifies that the authentication factor is securely stored in a hardware-backed key store, such as:

• Apple Secure Enclave (iOS/macOS).
• Android StrongBox.
• Windows TPM (Trusted Platform Module).
• Reference: Possession factor constraints.

Authentication factors that typically satisfy this constraint

• WebAuthn (FIDO2).
• Platform or roaming security keys (like YubiKey).
• Okta Verify, only when installed and registered on a supported hardware-backed device.

Okta Verify Behavior in Persistent vs. Non-Persistent Environments

As a result, Okta Verify fails to meet the hardware-protected condition in these scenarios.

Conclusion

In non-persistent virtual environments, Okta Verify should not be relied upon to fulfill the Hardware protected policy constraint. For compliance with hardware-backed or phishing-resistant requirements, organizations should consider alternative authentication methods such as:

• WebAuthn with security keys.
• Okta FastPass on physical devices with TPM/Secure Enclave.
• Biometric WebAuthn on supported devices.

Recommendations

Avoid assigning Hardware protected policy requirements to users accessing applications via VDI or ephemeral desktops.
Use group-based or device-based conditional policies to differentiate between persistent and non-persistent environments.
Educate end users and IT admins on the limitations of Okta Verify in virtualized platforms.