TecMFA extends Okta's MFA policies to desktop login on Windows, macOS, and Linux, challenging users with the MFA factors configured in Okta before granting access to their device. It also enables self-service password reset and account unlock from the lock screen.
Comparing desktop authentication options?
TecMFA, TecZERO, and Okta Device Access (ODA) all bring Okta-backed authentication to desktop login, but they solve the problem in different ways, at different price points. Which one fits depends on the customer's environment and your strategy. Read the full side-by-side comparison before you decide. You can also read more about how TecMFA works.
Example scenarios
A customer runs a mix of Windows and Linux workstations and needs MFA at desktop login across both.
A customer in a regulated industry (such as healthcare or finance) must enforce MFA at the desktop to meet data-protection requirements but needs to keep passwords as part of its login process.
A customer's help desk is overwhelmed with password reset and account unlock tickets and needs a way for users to self-serve both directly from the desktop lock screen.
Key use cases
MFA enforcement at Windows, macOS, and Linux desktop login
Self-service password reset and account unlock from the lock screen
Protection against keyloggers and plaintext-password harvesting
Desktop MFA for Okta Classic tenants (not just Identity Engine)
Secure desktop authentication for remote and hybrid workforces
Offline MFA when the workstation can't reach Okta cloud
When to use
The customer needs MFA at desktop login, not just for web apps
The environment includes Linux desktops, or older Windows versions, or RDP
The customer is on an Okta Classic tenant
The customer wants self-service password reset and unlock at the lock screen
Cost-effectiveness matters and Okta FastPass to the desktop isn't required
The customer keeps passwords as part of their authentication strategy (TecMFA supports password-plus-factor; TecZERO does not)
Why it wins
Broad environment support — Windows (ARM and x86/x86-64), macOS, and Linux
Works with both Okta Classic and Okta Identity Engine tenants
Supports RDP, standalone devices, EntraID-joined, and on-prem AD-joined scenarios
Cost-effective at $1 per user / month
Offline MFA with configurable fail-open and fail-close modes
Self-service password reset and unlock reduce help-desk load
Before you sell
TecMFA does not extend Okta FastPass to the desktop; if this is a requirement, Okta Device Access is the fit.
Three versions exist: TecMFA Classic (Okta Classic and OIE) and TecMFA OIE (Identity Engine only), plus a portal version. ZeroTek can help you determine which version is the best fit. Email [email protected] for assistance.
The OIE version has some features still under development — see the TecMFA Help Center article for the current list before committing in OIE-only environments.
Passwordless login on OIE tenants isn't supported by TecMFA; for fully passwordless desktop login, see TecZERO.
Not the right fit for customers who specifically need Okta FastPass at the desktop, or who are committed to a fully passwordless strategy.
Pricing
ZeroTek Partners can see ZeroTek licensing, pricing, and billing for details.
Get add-on
Email [email protected] to get started with this add-on.
Still weighing TecMFA against TecZERO or Okta Device Access after reading this and the comparison guide? ZeroTek can help you confirm the right fit for a specific customer environment. Email [email protected] for assistance.