How to Configure Addigy Identity with Okta

Configuring Addigy Identity with Okta lets end users log into their macOS devices using their existing Okta credentials — no separate local password to manage or reset. See the Addigy Identity Overview for more on what Addigy Identity does.

How to Enable Addigy Identity

1. Navigate to Account > Integrations > Addigy Add-ons.
2. Click Addigy Identity and toggle on Enabled in the top right. Once enabled, you'll see a green outline and checkmark. 
   

How to Select Okta as Your Identity Provider

1. Navigate to Policies > Integrations & Settings > Identity.
2. Select Okta. 
   
3. The Client ID, Domain, and Redirect URI fields appear — you'll fill these in once you've registered an application in Okta (below). 
   

Note: You'll need admin-level permissions in your Okta instance to complete this setup.

How to Register an Application in Okta

1. Log in to Okta's Admin Console.
2. Go to Applications > Applications in the sidebar.
3. Click Create App Integration. 
   
4. In the Creating a new app integration window:
   • Select OIDC - OpenID Connect as the Sign-in method.
   • For Application type, select Native Application, then click Next. 
     
5. In the New Native App Integration form, under General Settings:
   • Enter an App integration name, such as Addigy Identity.
   • (Optional) Upload a logo.
   • For Grant Type, leave Authorization Code as the default.
   • In the Sign-in redirect URIs section, click Add URI:
     • Type https://addigy- into the field.
     • Find your organization's Okta URL from the top-right dropdown menu of your Okta dashboard, copy it, and paste it directly after what you typed. 
       
     • This produces a URI similar to: https://addigy-dev-XXXXXXXXX.okta.com
     • Remove the default callback Sign-in Redirect URI and the Sign-out Redirect URI.
   • Scroll to Assignments and choose the Control Access option that works best for your organization.
     • If you choose Allow everyone in your organization to access, make sure Enable immediate access with Federation Broker Mode is deselected.
   • Once your configuration matches the example below, click Save. 
     
6. With registration complete, collect the values you'll need for the next step:
   • Under Client Credentials, copy and save the Client ID. 
     
   • Find your organization's Okta URL again from the top-right dropdown menu. 
     
   • Scroll to the Login section and copy the Sign-in redirect URI. 
     

How to Finalize Addigy Identity Configuration

1. Back in Addigy, enter the Client ID, Domain, and Redirect URI. 
   

Note: Use the same Redirect URI value from Okta for Addigy's Redirect URI field — for example, https://addigy-dev-XXXXXXXXX.okta.com. Be sure to keep the https:// prefix.

API Access Management:

• If your organization pays for Okta's API Access Management SKU, leave this checkbox enabled.
• If your organization doesn't pay for it, uncheck the box, leaving it disabled.

How to Customize Addigy Identity

Enable or disable the available settings to customize how Addigy Identity behaves.

See the Addigy Identity Overview for how each setting affects the end-user experience.

Collect User Attribute Data

Enable this setting to collect user attribute data.

To configure which attributes are collected, see Addigy Identity User Attributes for Okta.

Login Window Theme

Customize the login window's theme by uploading a background image and logo.

Scroll to the bottom of the page and click Save Changes. Once saved and the policy deploys, Addigy Identity installs on end-user devices. After the user reboots their device, they can authenticate seamlessly with their organizational email and password. See Addigy Identity End User Experience for how this appears to end users.

Frequently Asked Questions

Why does my Redirect URI need to start with "https://addigy-"?

This naming convention, combined with your organization's Okta domain, is what Okta expects for the native app integration's sign-in redirect. Using a different format can cause the redirect to fail during sign-in.

Should I leave API Access Management enabled?

Only if your organization pays for Okta's API Access Management SKU. If you don't have that SKU, leave the checkbox unchecked — enabling it without the SKU won't work correctly.

I'm getting login loops or 400/403 errors during setup or sign-in — what should I check?

These are common Okta configuration issues. See Addigy Identity Troubleshooting for specific fixes.

Related Articles

• Addigy Identity Overview
• Addigy Identity User Attributes for Okta
• Addigy Identity End User Experience
• Addigy Identity Troubleshooting