Passwordless Offline Biometrics for Desktop MFA

Hi @MonteD.49528 (Customer)​ , Thank you for reaching out to the Okta Community! 

Your configuration looks correct and I haven't seen any similar reports. 

The only thing I can think of is the "PasswordlessAccessEnabled" registry key description mentioning that 

"Password autofill supports Okta Verify Push, FIDO2 keys and Windows Hello biometrics when you specify these as AllowedFactors. Desktop MFA always attempts to enforce user verification through the FIDO2 key PIN. If the key doesn't have a PIN, then Desktop MFA falls back to password authentication."

If you continue experiencing issues with the implementation, please open a case to work with our colleagues from the Okta Support team. They can set up a meeting go over the configuration with you.  

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Securing AI agents across your org? Join our upcoming Ask Me Anything on 8/5 about Okta for AI Agents. Ask our expert questions.

Hi Mihai,

Thank you for responding and confirming that our config looks correct. We aren't using FIDO2 keys and we haven't specified it in the AllowedFactors registry key. Therefore, I don't think that's the issue.

I'll open a support case.

Updating this response for ease of access and reference:

Okta Verify Desktop Multi-Factor Authentication (MFA) prompts for a password during offline login despite the configuration of offline biometrics. This fallback occurs when the FIDO2 key lacks a Personal Identification Number (PIN). Configuring a PIN for the FIDO2 key resolves the issue.

During an offline login attempt using Okta Verify for Windows version 6.11.1.0 or later, the authentication process skips the biometric prompt and requires a password. This happens even when the PasswordlessAccessEnabled registry key has a value of 1 and AllowedFactors includes Offline_Fingerprint or Offline_FaceBio.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Verify for Windows
• Desktop Multi-Factor Authentication (MFA)

Cause

The PasswordlessAccessEnabled

registry key supports Okta Verify Push, FIDO2 keys, and Windows Hello biometrics. Desktop MFA always attempts to enforce user verification through the FIDO2 key PIN. If the FIDO2 key lacks a configured PIN, Desktop MFA falls back to password authentication.

Solution

What steps resolve the offline biometric password fallback?

Configure a PIN for the FIDO2 key and verify the registry settings to ensure passwordless offline access functions correctly.

1. Configure a PIN for the FIDO2 key.
2. Verify the registry keys at HKLM\SOFTWARE\Policies\Okta\Okta Device Access include the correct values for AllowedFactors and PasswordlessAccessEnabled.
3. Attempt the offline login again using the biometric factor.
4. Review the Configure Windows MFA policies documentation for additional configuration details.
5. Contact Okta Support for further assistance if the issue persists.