---
title: "Passport Configuration with Okta"
slug: "passport-configuration-with-okta"
updated: 2025-07-24T19:05:10Z
published: 2025-07-24T19:05:10Z
canonical: "support.kandji.io/passport-configuration-with-okta"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Passport Configuration with Okta

> [!WARNING]
> If you experience any issues with Passport & Okta, read through our [Passport Troubleshooting with Okta](/v1/docs/passport-troubleshooting-with-okta) article for more information.

### Okta Application Configuration

When configuring the Passport Library Item, you need the **Client ID** (Application ID) and **Identity provider URL**. Use these steps to configure the OIDC app and collect the required information.

1. In your Okta Administrator Console, in the left menu pane, expand the Applications section and select **Applications**.
2. Click **Create App Integration**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1008AM@2x.png)
3. For **Sign-in method**, select **OIDC - OpenID Connect**.
4. For Application Type, select **Native Application**.
5. Click **Next**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6m3gda85qwx6oi-sp6gzbllpphtilinemw.png)
6. In the **App integration name** field, enter a name such as *Kandji Passport*.
7. In the **Grant type** section, confirm that the checkbox for **Refresh Token** is deselected. This option must be turned off to ensure that Passport prompts users to update their Mac password while logged in if their Okta password changes.
  - The **Store user password** setting in the Passport Library Item needs to be set to **Securely store password** for users to receive the password update prompt. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/cz-4p6xddcml68xdioqiuxlwb8psiwqsja.png)
8. If you’re using Okta Identity Engine, click **Advanced** to show additional options.
9. In the **Other grants** section, select the checkbox for **Resource Owner Password**.

Note: If your Okta instance hasn’t yet been updated from Classic to Okta Identity Engine (OIE), the **Interaction Code** grant type and other options, will not be displayed.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0951AM@2x(1).png)
10. In the **Sign-in redirect URIs** section, click **Add URI**.
11. In the new field that appears, enter the following:

```bash
https://localhost.redirect
```

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/HwiY-S39tmzsv1H5gMgSqsxp3iu21yiXfg.png)

> [!NOTE]
> The same Sign-in redirect URI must be used in the Passport Library Item in the Redirect URI field in the Authentication mode section.
12. In the Assignments section, select whether to assign the app integration to everyone in your org, only selected group(s), or skip assignment until after app creation. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/5tugr09k1kbvbnevh-r9tg3czyxksubb5g.png)
13. Click **Save**.
14. Open a secure text document that you can use to store values for this OIDC app. You will need these details when you configure the Passport Library Item.
15. In the General tab of the OIDC application you just created, on the right side of the **Client ID** field, click the **copy icon** (looks like a clipboard). ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1004AM@2x.png)
16. Paste the value into your secure text document.
17. Copy the formula for your **Identity provider URL** from the following text:

```bash
https://yourOktaDomain/.well-known/openid-configuration
```
18. Paste the text into your secure text document.
19. In your secure text document, replace yourOktaDomain with your Okta domain.

> [!NOTE]
> You do not need a custom Sign-On Policy Rule, but if you add one, ensure MFA is disabled.

> [!NOTE]
> With the Okta configuration complete, assign the app to the users using Passport to sign in to their Mac systems, and go to the Kandji web app to [configure the Passport library item](/v1/docs/configure-the-passport-library-item).

### Enable Multi-factor Authentication (MFA)

> [!WARNING]
> The MFA policy in Okta should be applied to Users or Groups, not to the Passport Application in Okta.

When using MFA with Passport, a few settings need to be modified in Okta, and in the Passport Library Item in your Kandji web app. Below are MFA instructions for [Okta Identity Engine (OIE)](/v1/docs/passport-configuration-with-okta#okta-identity-engine) and [Classic Engine](/v1/docs/passport-configuration-with-okta#classic-engine).

#### Okta Identity Engine

**Okta Authenticators**

1. Expand the **Security** section from the lefthand navigation.
2. Click **Authenticators**.
3. Ensure that at least one multifactor authentication method, such as Okta Verify, is listed.
4. If no multifactor method is listed, click the **Add authenticator** button. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1008.png)
5. Click the **Add** button below the authenticator(s) that are needed. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/xhlljhzxb_u0qjq4od5ov4_brikrjb5_jg.png)
6. Complete any additional steps for the authenticator.
7. Click **Add**.

**Okta Global Session Policy**

1. Expand the **Security** section from the lefthand navigation.
2. Click **Global Session Policy**.
3. Click Add policy.
4. Or click the pencil to edit the existing **Default Policy**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1009.png)
5. Set **Multifactor authentication (MFA) is** to Required.
6. Set **Users will be prompted for MFA** to **At every sign in**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/yo7oyq_fnhmxx3pvec5ouh-njotlucgegw.png)
7. Scroll down and click **Update rule** or **Create rule**.

**Authentication Policies**

1. Expand the **Security** section from the lefthand navigation.
2. Click **Authentication Policies**.
3. Click **Applications**.
4. Click **Switch policy** next to your Kandji Passport application. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1010.png)
5. Select **Password only** for the **Use this policy for Kandji Passport** policy.
6. Click **Save**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/d1fjzx35sxt3xvzfrgweykdfvpufgsbkgg.png)

#### Classic Engine

**Okta MFA Settings**

1. Expand the **Security** section from the lefthand navigation.
2. Click **Authentication**.
3. Click **Sign On**.
4. Click **Add New Okta Sign-on Policy** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1011.png)
5. Enter a **Policy name** similar to MFA Required.
6. Enter a **Policy Description**.
7. Select the groups that will be assigned to this MFA requirement.
8. Click **Create policy and add rule**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/npsmpvffdz6hupgmkzhd6wbdlk1omygmja.png)
9. Enter the **Rule name**.
10. Select **Required** for the **Multifactor authentication (MFA) is** setting.
11. Select **At every sign in** for the **Users will be prompted for MFA** setting. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/gh0_vul0jmqibi-8mgwmzsznyehchsvdgq.png)
12. Click **Create rule** at the bottom of the window. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6ocdes12chjadqfbmh_k3e1zqv-ddcwmhw.png)

#### Library Item Settings

1. Select the radio button next to Web Login in order to support multi-factor authentication (MFA).
2. In the Redirect URI field, enter the following:

```bash
https://localhost.redirect
```

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1021AM@2x.png)
3. Click the Save button.

### User Provisioning

Follow these steps if you plan to use the Group information in Okta to determine the user account type. The groups you use in Okta don't have to start with *Mac-* but these steps use *Mac-* as an example.

1. In the Passport Library Item, click the User account type menu in the User provisioning section and select **Specified per identity provider group**.
2. Select the **Default account type** from the drop-down.
3. In the **Identity provider group** fields, enter your Okta group names. This article uses groups that start with *Mac-* as an example.
4. For each **Identity provider group** row, set the **Account type** as appropriate. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1022AM@2x.png)

Next, In Okta, in your Passport OIDC application, use the following steps to configure the Group claim filter to start with *Mac-* as an example.

1. In your Okta Administrator Console, in the left menu pane, expand the Applications section if necessary, then select **Applications**.
2. Select the **Kandji Passport** application that you previously created.
3. Click the **Sign On** tab.
4. In the **OpenID Connect ID Token** section, click Edit.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bxpccwjei6z39cym1demptkonor46rjbhw.png)
5. In the **Groups claim filter** section, leave the default value: **groups**.
6. Leave the middle field at the default: **Starts with**.
7. In the right-most field, enter **Mac** (assuming the Okta groups you use or will use start with **Mac**).![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/b8oplm8pc6z0y6xlteg92xto3uiyhczzaa.png)
8. Click **Save**.

### Troubleshooting Issues with Passport & Okta

If you experience any issues with Passport & Okta, read our [Passport Troubleshooting with Okta](/v1/docs/passport-troubleshooting-with-okta) article for additional information.