How SecureW2 Works With Okta to Strengthen Your Security Defenses

As of January 2025, Okta FastPass adoption nearly doubled year over year, climbing from 6.7% to 13.3%, and for good reasons: Organizations are recognizing that passwords alone cannot reliably defend against phishing, credential theft and account takeover attacks.

FastPass is a powerful, user-friendly and phishing-resistant ally in the fight to keep web applications safe. And when it’s combined with SecureW2, Okta FastPass’s capabilities extend far beyond Okta’s perimeter to deliver seamless security across applications, Wi-Fi, 802.1X and more.

How Okta FastPass Works

FastPass is Okta’s cryptographic authenticator that deliverspasswordless authentication for applications protected by Okta through SAML, OpenID Connect (OIDC), or WS-Federation. FastPass uses public-key cryptography with device-bound private keys together with the device’s built-in platform authenticator (Windows Hello, Touch ID, Face ID or similar) to verify user identity without ever transmitting passwords.

Using Okta FastPass gives end users the same passwordless login experience across both managed and unmanaged devices, while simultaneously preventing the most common phishing attacks.

When Okta FastPass Is Enough … And When It Isn’t

While Okta FastPass excels at securing access to applications protected by Okta, it does not natively extend passwordless authentication to network infrastructure such as Wi-Fi, VPNs or wired 802.1X connections.

For organizations that:

• Limit access to Okta-federated apps,
• Use FastPass with biometrics to reduce the risk of phishing, and
• Aren’t running high-sensitivity workloads that require immediate certificate revocation at the protocol layer,

Okta FastPass may be enough.

But for organizations that:

• Need to control access to Wi-Fi, VPN, switch ports or non-Okta APIs,
• Need phishing-resistant controls on non-Okta-federated apps,
• Are running high-sensitivity workloads that require immediate access revocation,

Okta FastPass falls short.

Rather than replacing FastPass, organizations can extend its identity assurance by pairing it with certificate-based network authentication.

See our video below for a breakdown of Wi-Fi certificate authentication:

Extending Okta Trust Signals With Certificates

Infrastructure services like Wi-Fi, VPNs and wired networks typically rely on 802.1X authentication rather than SAML or OpenID Connect, making them outside FastPass’s native scope.

SecureW2 extends the Okta-established trust through digital certificates tied to verified user identities. When a user successfully authenticates with Okta, the certificate can be used to authenticate the device to Wi-Fi, VPN and other certificate-enabled services without requiring passwords or shared credentials.

Together, Okta and SecureW2 create a seamless passwordless experience from the initial identity verification through ongoing network access. Users authenticate once with Okta, while certificates provide continuous, phishing-resistant authentication across enterprise infrastructure.

In our video below, we explain how SecureW2 integrates with Okta to deliver phishing-resistant authentication while incorporating device compliance and security posture data from platforms like Jamf and Intune. Check it out:

One Certificate, Many Applications: Okta + SecureW2 Use Cases

Okta uses client certificates to support Device Trust and management attestation for FastPass on managed devices. SecureW2 builds its platform around certificate-based identity. What many organizations don’t realize is that these don’t have to be separate certificates. Whether certificates are issued by the Okta Certificate Authority (CA), JoinNow Dynamic PKI or a third-party CA, the same identity certificate can be trusted across multiple applications and authentication workflows.

Instead of managing separate credentials for Wi-Fi, VPN, desktop login and web applications, organizations can extend a single certificate across their entire identity ecosystem.

Here are the most common Okta + SecureW2 use cases:

Passwordless Wi-Fi and Wired 802.1X With Dynamic Okta Policies (EAP-TLS)

SecureW2 JoinNow Cloud RADIUS integrates directly with Okta to authenticate users via EAP-TLS instead of passwords. On every authentication attempt, Cloud RADIUS performs a live lookup against Okta for current user status and group membership. Administrators can dynamically assign virtual area local networks (VLANs) and network policies based on those real-time attributes. If a user is disabled or moved to another group in Okta, the change takes effect at the next authentication attempt, without waiting for certificates to expire or for a separate revocation process.

VPN Authentication and Continuous Trust

Organizations can replace passwords and shared secrets with client certificates for VPN authentication. For platforms that do not natively support certificate-based RADIUS, SecureW2 also supports token-based authentication, extending access to a broader set of VPN solutions.

Continuous Trust policies further evaluate identity, device posture and risk signals throughout the authentication lifecycle by ingesting data from Okta, endpoint detection and response (EDR) platforms and mobile device management (MDM) systems, so access decisions remain current even after the initial connection.

Okta Device Trust and Certificate Enrollment for Device Access

SecureW2 can issue hardware-bound certificates through ACME Device Attestation or Dynamic SCEP that satisfy Okta Device Trust requirements. Organizations can use JoinNow Dynamic PKI or another trusted CA while still benefiting from automated certificate lifecycle management, audit logging, and hardware-backed device identity.

The same platform supports certificate enrollment for Okta Device Access across Microsoft Intune, Jamf Pro and Workspace ONE, using static, dynamic or delegated challenge methods.

Certificate-Based SSO and Client-Cert Authentication to Web Apps

Organizations can configure an Okta Smart Card identity provider (IdP) using certificates issued by SecureW2 or another trusted CA. Authentication policies can require certificate-based authentication for specific applications or user groups, eliminating password-based sign-in for high-security resources.

PIV and Smart Card Authentication at Scale

The SecureW2 Smart Card Management System simplifies large-scale deployment of YubiKeys and derived Personal Identity Verification (PIV) credentials for Windows desktop login, Windows Hello for Business and Okta authentication. Automated provisioning and private key attestation eliminate the manual command-line processes traditionally required for smart card deployments.

Adaptive Authentication With Okta Identity Threat Protection

Okta Identity Threat Protection can share identity risk signals with SecureW2 to strengthen certificate-based authentication decisions. Risk scores, user status and endpoint telemetry from EDR platforms such as CrowdStrike, Microsoft Defender and Palo Alto Networks can be incorporated into certificate issuance and validation policies, supporting near-real-time suspension and revocation when risk conditions change.

Securing AI Agents and Non-Human Identities

As organizations deploy AI agents, scripts, and containerized workloads, certificates can replace static API keys and long-lived tokens with mutual TLS (mTLS). Increasingly, certificate-based machine identities are becoming an important component of Zero Trust architectures.

Get More Out of Okta FastPass With SecureW2

Okta FastPass answers: is this the right user, on a known device, signing into an Okta-federated app?

SecureW2 certificates answer a broader question: can this device cryptographically prove who it is to any system that asks, including everything Okta doesn’t sit in front of (Wi-Fi, VPN, wired 802.1X, mutual TLS APIs, SSH, desktop login, AI agents)?

Okta controls who has access, but it wasn’t built for independent network and infrastructure enforcement.

Legacy on-premises PKI and RADIUS may treat IdP data as a one-time input at enrollment. SecureW2 treats it as a live signal at every authentication event.

SecureW2 Cloud RADIUS validates users and devices against real-time IdP data on every network connection request, so a user deprovisioned in Okta loses certificate-based access at the next authentication attempt, not at the next sync cycle.

Access is removed when a user or device is offboarded, without relying on manual certificate revocation processes.

Our RADIUS and PKI extend Okta’s high-caliber security beyond the Okta boundary to incorporate Wi-Fi, VPNs, AI agents and more. Check out our demo for a closer look.