When using UseDirectAuth, users are unable to authenticate with FIDO2 security keys or Okta Verify push/TOTP. This is a known issue with Windows Desktop MFA in Okta Device Access (ODA) when using Okta Verify version 5.5.4 or later.

Okta Admins will see the following events in the Okta system log:

‘login_hint’ did not match a user assigned to the client app. FAILURE: mfa_attestation_login_hint_invalid

Corresponding ODA client logs will show:

<year>-<month>-<day> <hh>:<mm>:<s>.<ss> <TZ> [INF] [ :large_blue_square: ] [Fido2Manager::CancelAssert] No active FIDO2 assertion to request cancel.
<year>-<month>-<day> <hh>:<mm>:<s>.<ss> <TZ> [INF] [ :large_blue_square: ] [DirectAuthClient::CallDirectAuthApi] Calling https://<OktaSubDomain.okta.com/oauth2/v1/primary-authenticate path:/oauth2/v1/primary-authenticate loginHint: <HIDDEN> grantType: intent= acrValues:urn:okta:app:mfa:attestation scope: channelHint: oobCode:
<year>-<month>-<day> <hh>:<mm>:<s>.<ss> <TZ> [INF] [ :large_blue_square: ] [DirectAuthFido2UserChallenge::InitChallengeAsync] InvalidOperationException access_denied The required authenticator cannot be used. Check if it is required by policy and the user is enrolled in the authenticator and try again. Forbidden
<year>-<month>-<day> <hh>:<mm>:<s>.<ss> <TZ> [INF] [ :large_blue_square: ] [UserLogonSession::InitChallengeAsync] Init challege: 'Security key (USB) ':ExternalWithPin:Online Result=Failure (msg=Challenge failed.)

• Okta Identity Engine (OIE)
• Okta Device Access (ODA)
• Desktop Multi-Factor Authentication (MFA)
• Windows Okta Verify

This issue occurs when the Okta username does not match the Active Directory User Principal Name (UPN) for Active Directory-joined devices. For Entra ID-joined devices, this issue occurs when the Okta username does not match the Entra ID UPN.

If the Okta username assignment cannot be changed to match the required values detailed above, Okta Admins may configure multiple identifiers in the user profile policies to allow users to be identified by an additional attribute. This attribute should contain the username from Active Directory (AD) or Entra ID, depending on the environment (see Add identifiers to a user profile policy).

Create New Profile Attribute

If the desired custom attributes are not in the user's profile, they may be created or added. Custom identifier attributes cannot be hidden or contain sensitive information. Be sure to set the Data type to string and the Restriction to Value must be unique for each user.

 To Create a New Profile Attribute:

1. In the Okta Admin Console, navigate to Directory > Profile Editor.
2. Choose Okta > User (default).

3. Select Add Attribute.

4. Configure the values for:
   1. Data type: string.
   2. Display name: Enter a descriptive name to display for the attribute in the Okta Admin Console.
   3. Variable name: Enter a name for the attribute that can be referenced in mappings.
   4. Description: Enter a description of the attribute.
      • This is optional, but consider adding a description to keep track of the attribute's purpose.
   5. Select Value must be unique for each user. 
      • This requires the attribute to be unique for every user.
   6. Keep user permissions as Read Only.

4. Select Save.

Mapping Value to Attribute 

For Active Directory-joined devices, map the UPN to the custom attribute created above. For Entra ID-joined devices, map the Entra ID UPN to the attribute created above.

1. Navigate back to Directory > Profile Editor in the Okta Admin Console.
2. Choose the Active Directory integration.

3. Choose Mappings.
4. Scroll to the bottom, and map UPN (appuser.userName) to the attribute created above (in this example, altUsername). 
5. Choose Save Mappings.

6. Choose Apply updates now.

Add Identifiers to a User Profile Policy

1. In the Okta Admin Console, go to Security > User Profile Policies.
2. Click the +Add user profile policy button. Enter a name for the policy, such as "DesktopMFA".
3. Locate the new policy, and then click its Edit icon.

4. On the Identification tab, click Add identifier.

5. Search for and select an attribute in the dropdown menu.

6. Select Apps and Select + Add an App to This Policy.

7. Find the Desktop MFA application and select Close. If there are multiple Desktop MFA applications, they can all be added to this policy.

8. Click Save.