Okta Certified Administrator · Part I

Identity and Access Management

36% of the exam — the single largest domain.

Identity & Access Management

Module 3: Desktop SSO Deployment Federation

1 sub-topic · this deck covers the whole module

The Exam Bullet

"Demonstrate knowledge of how to deploy Agentless Desktop SSO"

A user already logged into their Windows domain shouldn't have to log in again just to reach Okta. This sub-topic is about how Desktop Single Sign-on (DSSO) makes that automatic — without installing a dedicated agent for it.

The Mechanism

With Desktop Single Sign-on (DSSO), a user is automatically authenticated by Okta the moment they sign in to the Windows network. From there, they reach Okta-connected applications without re-entering credentials.

The "agentless" part matters: this doesn't require installing a separate DSSO agent — it works off the existing Windows domain sign-in itself.

What The Documentation Covers

Deploying this correctly touches several distinct areas, each with its own considerations:

Prerequisites · Known issues and limitations · Just-in-Time provisioning integration · Configuration steps for agentless deployment · Migration guidance from registry-key setups · Troubleshooting and FAQs

The Gotcha — Registry Key Migration

Organizations that were previously using registry keys to configure agentless SSO need to follow separate migration guidance to move to the current setup — it's not a drop-in replacement.

The Connection to JIT

DSSO's documentation explicitly covers Just-in-Time provisioning integration — the same JIT mechanism from Module 1, Submodule 1.

The pattern repeats: a user authenticates through some trusted mechanism (there, delegated auth against AD; here, an already-authenticated Windows session), and Okta uses that successful authentication as the trigger to provision or update their profile.

The Exam Angle

Watch for scenario questions built around this trap:

→ "An org still has registry-key-based agentless SSO configured and wants to modernize it." = follow the dedicated migration guidance, not a fresh install.

One Line To Remember

DSSO = users get auto-authenticated by Okta on Windows domain sign-in, no separate agent needed, no re-entering credentials for connected apps. It integrates with JIT provisioning the same way delegated auth does. Orgs on old registry-key setups need a dedicated migration path, not a fresh reconfiguration.

Sources: help.okta.com — ad-desktop-sso-main.htm

✓ Module 3: Desktop SSO Deployment Federation — complete (1 of 1 sub-topic)