# Specific Mobile devices Bypass MFA Authentication Policy

**URL:** <https://devforum.okta.com/t/specific-mobile-devices-bypass-mfa-authentication-policy/34184>\
**Category:** Questions\
**Created:** [August 26, 2025, 6:19pm UTC](https://devforum.okta.com/t/specific-mobile-devices-bypass-mfa-authentication-policy/34184 "2025-08-26T18:19:04Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![mathewwade](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mathewwade/32/6246_2.png) [@mathewwade](https://devforum.okta.com/u/mathewwade)\
**Post date:** [September 20, 2025, 1:16pm UTC](https://devforum.okta.com/t/specific-mobile-devices-bypass-mfa-authentication-policy/34184/2 "2025-09-20T13:16:58Z")

</div>

You can keep the Starlink devices from being prompted for MFA without opening things up to everyone by tying the bypass to _trusted devices_ (not just IPs). Common approaches are: enroll those physical devices into your MDM and use Okta **Device Trust** (so policies can check device posture), or terminate device traffic through a small VPN/NAT gateway that gives those devices a stable outbound IP range. Another pattern is to put the specific users/devices in a dedicated Okta group and create an authentication policy rule that allows reduced MFA for that group **only when** Device Trust (or a specific network zone) is present plus strict logging and short TTLs. For ideas others have discussed, see this similar thread: [https://devforum.okta.com/t/how-to-bypass-mfa-code/23976.](https://devforum.okta.com/t/how-to-bypass-mfa-code/23976)

---

_[View the full topic](https://devforum.okta.com/t/specific-mobile-devices-bypass-mfa-authentication-policy/34184)._