Passwordless Sign-in with Okta IDV Standard

You can configure a passwordless sign-in experience using Incode IDV and
Okta Fastpass. In this flow, users authenticate with Okta Verify with
Fastpass instead of a password. Incode IDV is used during the initial
enrollment step to verify the user's identity before Fastpass is provisioned
to their device.

📘

Prerequisite

This guide assumes you have completed the
Okta IDV Standard
setup guide. The Incode IDV identity provider must be active in your Okta
instance before configuring this flow.

Prerequisites

• You have completed the
  Okta IDV Standard
  setup guide
• Okta Verify is installed on users' devices
• Okta Device Trust is configured for your organization
• Familiarity with Okta Fastpass configuration and Okta passwordless
  sign-in setup

How it works

This flow uses Incode IDV as a one-time identity proofing step during
Fastpass enrollment. It does not invoke Incode on every sign-in — only
during the initial setup of Okta Verify on a user's device.

The enrollment sequence works as follows:

1. A user's password is removed from their Okta profile and their
   authenticators are reset.
2. The user opens the Okta Verify app and begins enrollment using your
   organization's domain.
3. Okta's enrollment policy requires identity verification — Incode IDV is
   invoked and the user completes a document and biometric check on their
   device.
4. On successful verification, Okta provisions Fastpass to the device.
5. From that point forward, the user signs in using Okta Verify with
   Fastpass — no password required.

Set up guide

Step 1: Configure authenticators

1. Log in to your Okta Admin Console.
2. Navigate to Security → Authenticators.
3. Edit Email and enable it for both Authentication and Recovery.

Step 2: Set up an enrollment policy

1. Under Authenticators, select Enrollment.
2. Edit an existing enrollment policy or add a new one tied to the group
   of users you want to enroll in passwordless (for example, a group named
   Incode Identity Verification).
3. Set Email and Okta Verify as required authenticators in the
   policy.

📘

Tip

Okta recommends keeping admin users in a separate group with password
access maintained to avoid locking out administrators.

Step 3: Create a passwordless authentication policy

1. Navigate to Security → Authentication Policies.
2. Create a new policy (for example, Passwordless Policy).
3. Set the Catch-all Rule to Deny.
4. Add a new rule with the following configuration:
   • Rule name — for example, Incode Passwordless
   • IF — User's group membership includes — your passwordless users
     group
   • THEN — User must authenticate with — Possession factor
   • In the Allowed Authenticators list, ensure only Okta Verify —
     Fastpass is shown. Use Allow specific authentication methods if
     additional control is needed.
5. Assign the Okta Dashboard app to this policy.

Step 4: Update the Global Session Policy

1. Navigate to Security → Global Session Policy.
2. Edit your Global Session Policy rule.
3. Set Establish the user session with to Any factor used to meet
   the Authentication Policy requirements.
4. Save the rule.

Step 5: Enroll and test

1. Reset a test user's authenticators and remove their password from the
   user's Okta profile.
2. Have the test user sign in to the Okta Verify app directly using your
   organization's domain.
3. The user will be prompted to verify their identity via Incode IDV before
   Fastpass is provisioned to their device.
4. After successful verification, confirm the user can sign in using Okta
   Fastpass without a password.

📘

If the test fails

If the user is not prompted for Incode IDV during enrollment, confirm
that the enrollment policy is applied to the correct group and that Okta
Verify is set as a required authenticator. If the user is prompted for a
password, verify that the catch-all rule in the passwordless
authentication policy is set to Deny and that the policy is assigned
to the Okta Dashboard app.

Next steps

• Configure claims matching
• Account resets & recovery