During Okta Verify onboarding on an iOS device, the QR code scan fails because the workstation has iCloud Private Relay enabled. To resolve this issue, disable iCloud Private Relay on the workstation before attempting to scan the QR code. When attempting to scan the QR code with the device camera, Okta Verify displays a red banner with the following error:

Unable to scan the QR Code

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Verify
• Apple iOS

Various factors cause this error, including:

• An active iCloud Private Relay on the workstation.
• An unsynchronized iPhone clock.
• An expired QR code.
• An active previous application instance requiring a multifactor authentication (MFA) reset in the Admin Console.
• Network connectivity issues are preventing registration.

How is the Okta Verify QR code scanning error resolved?

Address the potential causes by performing the applicable troubleshooting actions below.

How is iCloud Private Relay disabled?

Deactivate iCloud Private Relay on the workstation before attempting the enrollment process again.
To disable iCloud Private Relay, navigate to Settings > [Name] > iCloud > Private Relay and toggle it off

How is the iPhone clock synchronized?

Navigate to the device settings and toggle the automatic time configuration to synchronize the iPhone clock.

1. Navigate to Settings > General > Date & Time on the iPhone.
2. Toggle Set Automatically to the ON position. If it is already enabled, toggle it off, wait five seconds, and toggle it back on to force a synchronization.

How is a new QR code generated?

Refresh the page and immediately scan the new image to generate a new QR code.

1. Refresh the browser page on the computer to generate a new QR code.
2. Scan the new QR code immediately.

How is the authenticator reset?

Navigate to the user profile in the Okta Admin Console and reset the authenticator to clear previous enrollments.

1. Log in to the Okta Admin Console.
2. Navigate to the user profile.
3. Select Reset Authenticator or Reset Multifactor for Okta Verify.
4. Instruct the end user to attempt the enrollment process again.

How is network connectivity verified?

Connect the iPhone to a stable Wi-Fi network or cellular data to ensure an active internet connection.

1. Connect the iPhone to a stable Wi-Fi network or cellular data.
2. If a corporate guest Wi-Fi network blocks specific ports, disconnect from Wi-Fi and use cellular data temporarily.

How is the manual setup utilized?

Select the manual setup link on the computer screen and open the provided link on the iPhone to bypass the camera.

1. Select the Can't scan? or Setup manually without a QR code link located underneath the QR code on the computer screen.
2. Choose the option to send an SMS link or an email.
3. Open the link directly on the iPhone to launch the Okta Verify app and complete enrollment.