Configure Phishing-Resistant Authenticator Enrollment Policies

Configure phishing-resistant authenticators and create authenticator enrollment policies to enforce user enrollment.

Cancel Apply

rate limit

Code not recognized.

About this course

Course snapshot

Course summary

Attackers can bypass traditional MFA, such as push notifications, by intercepting session tokens on fake sign-in pages. This course shows administrators how to eliminate this vulnerability by configuring phishing-resistant authenticators and creating authenticator enrollment policies.

What skills does the course cover?

  • Identify the steps in a phishing-resistant authentication flow.
  • Explain the capabilities and benefits of phishing-resistant authenticators.
  • Configure the settings for phishing-resistant authenticators.
  • Create an authenticator enrollment policy to require enrollment in phishing-resistant authenticators.

Common questions addressed in the course

What happens if a user authenticates on a phishing site using a phishing-resistant authenticator?

The authenticator detects a domain mismatch between the browser URL and its registered key pair, refuses to sign the request, and automatically stops the attack.

How does a device-bound authenticator differ from a phishing-resistant authenticator?

Device-bound authenticators prevent private keys from leaving the device hardware. Phishing-resistant authenticators add cryptographic origin binding to verify the website URL, preventing proxies from intercepting the session.

Why should administrators avoid browser QR codes and email or SMS links during Okta FastPass enrollment?

These methods lack cryptographic binding to the device, exposing users to AiTM attacks and registration hijacking. Administrators should enforce same-device enrollment or device-to-device bootstrap instead.

About this course

Course snapshot

Course summary

Attackers can bypass traditional MFA, such as push notifications, by intercepting session tokens on fake sign-in pages. This course shows administrators how to eliminate this vulnerability by configuring phishing-resistant authenticators and creating authenticator enrollment policies.

What skills does the course cover?

  • Identify the steps in a phishing-resistant authentication flow.
  • Explain the capabilities and benefits of phishing-resistant authenticators.
  • Configure the settings for phishing-resistant authenticators.
  • Create an authenticator enrollment policy to require enrollment in phishing-resistant authenticators.

Common questions addressed in the course

What happens if a user authenticates on a phishing site using a phishing-resistant authenticator?

The authenticator detects a domain mismatch between the browser URL and its registered key pair, refuses to sign the request, and automatically stops the attack.

How does a device-bound authenticator differ from a phishing-resistant authenticator?

Device-bound authenticators prevent private keys from leaving the device hardware. Phishing-resistant authenticators add cryptographic origin binding to verify the website URL, preventing proxies from intercepting the session.

Why should administrators avoid browser QR codes and email or SMS links during Okta FastPass enrollment?

These methods lack cryptographic binding to the device, exposing users to AiTM attacks and registration hijacking. Administrators should enforce same-device enrollment or device-to-device bootstrap instead.