The RC4_HMAC_MD5 encryption method has reached End of Life (EOL) and can no longer be used for Okta Active Directory Single Sign-On (ADSSO) and Office 365 Silent Activation. Administrators must update the ADSSO service account to use the Advanced Encryption Standard (AES) encryption standard.

• Okta Identity Engine (OIE)
• Okta Classic Engine
  
• Active Directory Single Sign-On (ADSSO)
• Office 365 Silent Activation

What are the steps to update the ADSSO service account to use AES encryption?

Update the configuration and enable Advanced Encryption Standard (AES) encryption for Okta Kerberos authentications by modifying the Active Directory Single Sign-On (ADSSO) and Office 365 Silent Activation service account options in Active Directory.

1. Open Active Directory Users and Computers on the Domain Controller.
2. Find and right-click the service account.
3. Choose Properties.
4. Select one of the following AES checkboxes:
   • This account supports Kerberos AES 128-bit encryption
   • This account supports Kerberos AES 256-bit encryption
5. Ensure the Use Kerberos DES encryption types for this account checkbox is cleared, as this setting overrides AES encryption.

Related References

• Windows Configurations for Kerberos Supported Encryption Type