# Prerequisites

Before starting, ensure you have setup Incode Workforce IDV with Okta as described [here](https://workforce.developer.incode.com/docs/incode-okta-idv-configuration).

## Use your Workforce IDV with Okta Account Management Policy

- Okta's Account Management Policy defines how users must authenticate when they enroll authenticators or edit their personal information. See [Okta's documentation](https://help.okta.com/okta_help.htm?type=oie&locale=en&id=csh-account-management-policy) on Okta Account Management Policy for more information.

- How to require a user to use Incode Workforce IDV to verify their identity before they enroll a new authenticator method:

- Once your Incode IDV is [configured](https://workforce.developer.incode.com/docs/incode-okta-idv-configuration), log in to your **Okta Admin Console**.
  - **Create a group** with the initial users you want to test with, we will use a group named **Incode Workforce Identity Verification** in our example.
  - Navigate to **Security** from the left-side menu and select **Authentication Policies**.
  - Select **Okta Account Management Policy** at the top.

- Add a Rule to **Okta Account Management Policy** with the following settings configured:
    - **Rule Name:** Name your policy - ex. (Workforce Identity Verification Policy)

- IF:
      - **User's group membership includes:** Your Group name - ex. (Incode Workforce Identity Verification)
    - THEN:
      - **Access is:** Allowed after successful **Identity Verification**.

- Select your new Incode IDV you created.

_Note: New IDV option may not show up in dropdown initially but if you attempt to search for it, it should appear._

- The next time a user in your Workforce group attempts to reset or enroll an authenticator, Okta will prompt them to verify their Identity via Incode Workforce.

## Use your Workforce IDV with Okta Account Management Policy for Password Resets and Account Unlocks

Okta has a separate setting that needs to be configured to enforce password resets and account unlocks to use the Okta Account Management Policy. For Okta's Documentation see [here](https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/oamp-configure-account-recovery.htm).

- In your **Okta Admin Console**:

- Navigate to **Security** from the left-side menu and select **Authenticators**.
  - Find **Password**, select **Actions**, and **Edit**.
  - Edit your existing rule(s) or add a new rule assigned to your group. If you only have a default rule, you may need to add a new rule for Self-Service.

- Set your rule to use **Authentication policy** for Access control.

- The next time a user assigned to your Incode Workforce IDV group attempts to reset or unlock their account, it will prompt them to use Incode Workforce IDV to verify themselves before proceeding.
- For how to setup an Okta Passwordless sign-in experience see [here](https://workforce.developer.incode.com/docs/incode-idv-customize-your-sign-in-experience).