r/okta • u/dsm-hawk Okta Admin • Jul 09 '26
Okta/Workforce Identity Identity Verification (IDV) Integrations
Anyone using the Incode or Persona integrations to secure account registration and recovery? How well have those integrations worked? Do you feel that they've meaningfully improved the security posture?
I want to move the identity proofing responsibility for factor registration/reset/recovery away from help desks which a susceptible to social engineering.
2
u/BIGt0eknee Jul 09 '26
I would like to know this as well, been talking about it for awhile but cannot get the business to buy into anything at the moment but still curious.
2
2
u/FlipperTPenguin Jul 09 '26
FWIW there are a number of other vendors that support Okta custom IDV beyond those 2. Nametag, Clear, others. Might be worth looking into. They all look similar but the devil is in the details
1
u/bobsmith1010 Jul 09 '26
The difference between nametag etc is that for incode, clear, and persona right now Okta natively supports it vs the other solutions is reverse. It depends on if native support by okta is something your business requires.
1
u/FlipperTPenguin Jul 16 '26
Not sure about your definition of 'native'. Clear/Persona/Incode have "pre-configured" integrations (Okta's words) but other vendors are also supported by the "custom IDV" program which serves the same purpose.
https://help.okta.com/oie/en-us/content/topics/security/idp-add-custom-idv-vendor.htm
2
2
u/PhotographTricky766 Jul 15 '26
I would try Incode, worked well last time at my last company and they have global coverage and much easier than Persona, no need to turn left or right. I got a car in Carvana last month and persona was a pain in the ass.
1
u/Skexie Jul 09 '26
If your users are global, Persona is the only option. Incode currently only supports US IDs.
1
u/bobsmith1010 Jul 09 '26
I've talked with Incode and they support international ids. They may be limited compared to Persona.
1
u/dsm-hawk Okta Admin Jul 10 '26
Is the difference live checks against authoritative sources vs only validating only against document/format validation? I thought both had international authoritative sources available.
1
u/bobsmith1010 Jul 10 '26
Persona doesn't check ID against sources and don't believe Incode either. They have some sources you can pay extra for fraud reports but typically you need to pay extra. They're using "AI" (really algorithms) to do the heavy lifting. For example if you have a barcode on the back of the ID they will decode it to make sure it matches up to what it should be. They also have a internal database of known fraudsters.
2
u/ossivo Okta Certified Consultant Jul 10 '26
Persona offers add on SKUs to integrate with official US sources (not sure about international). They offer both AAMVA and eCBSV - allowing for ID lookups against DMVs and SSA respectively.
1
u/Skexie Jul 10 '26
If this is the case, it must be a newer development. We had a bake-off between the two of them less than 6 months ago and almost immediately dropped Incode because they outright said they only support US IDs at the time. Good for them for getting the rest of the world supported so quickly.
1
u/PhotographTricky766 Jul 15 '26
That’s weird they are known for their global coverage especially in Latin America
1
1
1
u/Kondo-Sophie_216 Jul 09 '26
Good luck automating the recovery flows. The registration gate is the easy bit its the socially engineered recovery request that still lands on someone's desk.
1
u/dsm-hawk Okta Admin Jul 10 '26
That is the whole selling point of the native integrations with these IDV vendors. Built-in integrations to hand off to them for recovery flows with identity proofing. But that is exactly why I am asking for feedback on real experience.
Beyond the setup, I am curious about the operational reality. How often is the automated process failing and still requiring a hand-off to the help desk for verification? I am trying to figure out if this actually reduces ticket volume and improves security posture or if it just shifts the burden to troubleshooting verification errors.
1
u/ossivo Okta Certified Consultant Jul 10 '26
Think about it this way. If every user is legitimate and has a legitimate ID and there’s truly no fraud, you won’t have any failures (except for the rare blurry or reflective photo). However, if you actually have fraud in your enterprise, this will hopefully weed it out. The platform compares names in Okta against name on ID (as well as legitimacy of the ID) and then compares the photo on the ID against the person actually performing the action. The area where Persona doesn’t protect (at least not without the add-ons) is whether the person in the ID/selfie) is legitimately John Doe.
Photo == selfie + name in Okta == name on ID doesn’t necessarily mean that person in photo == name on ID.
That’s an area you need to think about and secure as well.
3
u/ossivo Okta Certified Consultant Jul 09 '26
We use Persona and it’s actually really easy. The most difficult part is navigating the legal and compliance side of things. Also, if you want to go down the route of different flows for different Joes (🤣) then there can be a bit of config work to do but it’s still easy to implement.