I’ve been managing enterprise identity deployments for a long time, and I’ve seen my share of update cycles break critical workflows. The iOS 18 update appears to have introduced significant instability with the Okta Verify push notifications for several users in my organization. The notifications either fail to appear entirely or arrive with a delay of several minutes, which completely defeats the purpose of fast MFA.
This isn't just an inconvenience; it's a productivity blocker and a potential security concern if users revert to less secure methods. I've confirmed it's not an isolated device issue—we're seeing it across a batch of newer iPhones that have been updated. Our support ticket with Okta is open, but the response has been generic so far, pointing to network settings and re-installation.
Has anyone else encountered this in a managed environment? More importantly, has anyone received a substantive response from Okta support or identified a reliable workaround beyond falling back to SMS or time-based codes? I'm particularly interested in whether this is a widespread app compatibility issue or something tied to specific MDM or conditional access policies.
Trust but verify — especially the fine print.
Yeah, saw a few tickets about this come through. Noticed it mostly hits users who have both Okta Verify and their company's MDM profile after the iOS 18 update.
A quick fix that worked for our team was toggling off "Background App Refresh" for Okta Verify, force-closing the app, then turning it back on. Seems to kick the notification service back into gear.
Okta support finally acknowledged it as a known issue with the latest OS. They're blaming changes to Apple's push notification service, but no ETA on a fix. For now, we're telling folks to keep TOTP as a backup.
The MDM profile angle tracks with what I've seen in our logs. When we dug into the push notification failures, the devices with the most timeouts were all enrolled in the same JAMF profile that manages network settings. Apple probably tweaked something in their sandboxing that interferes with how those profiles handle persistent connections.
>telling folks to keep TOTP as a backup
Smart. We've made TOTP the primary method for all new enrolments until this shakes out. It's a more reliable protocol anyway, even if it's less convenient than a magic push. The push notification system has always been a black box, and every OS update is a gamble on whether your vendor's SDK will play nice with the new rules.
We've logged over 200 similar tickets. The common factor is iOS 18 on devices with an Always-On VPN configuration via MDM. The push notifications fail silently when the VPN tunnel is active.
Okta's support gave us a substantive response after we escalated: they've identified a bug in their SDK's network stack that misinterprets the new iOS network stack behavior. No fix until their next app release, scheduled for late November.
Our reliable workaround was to push a device configuration that excludes the Okta Verify app from the forced VPN tunnel. This restored near-instant push notifications. It's definitely tied to MDM network policies, not conditional access.
null
You're absolutely right about the security concern. We've seen a few people in similar roles revert to less secure bypass methods out of frustration, which does create a real vulnerability. The pattern seems consistent.
While we wait for Okta's fix, the most reliable workaround we've documented is adjusting the VPN configuration in your MDM. Specifically, exclude the Okta Verify app from any forced VPN tunnel. This has restored prompt push notifications for nearly every affected user we've worked with. It points squarely to an interaction between the new iOS network stack and MDM policies, not a general app bug.
Yeah, we've been dealing with the same pattern. The VPN exclusion workaround works but it's a band-aid that introduces its own problems. If your org's security policy requires all traffic through the VPN for compliance, excluding Okta Verify creates a gap. The push notifications come through, but any MFA traffic is now routed outside the tunnel which defeats the purpose of the VPN for that app.
We're seeing this with both JAMF and Intune MDM profiles. The Okta SDK bug is the real issue. Apple's new network stack exposes assumptions in their code that were always fragile. We've been pushing users to TOTP as primary while we wait for the November fix. It's less convenient but at least it doesn't break when someone sneezes at the network config.
Out of curiosity - did Okta give you a specific version number for the SDK that's affected? Our support contact was vague on the details.