Get okta authentication when approaching server past Fortigate

Hi

I'm asking because I have a question when I do okta certification at Fortigate.

Diagram is

Scenario

When users on INT side access SRV, they must obtain okta certification to access it.

Policy

1.

INT > SRV

S : SSO, User IP

D : Server IP

2.

INT >  EXT

S : User IP

D : ALL

This way, I can access the server after being authenticated.

However, ALL is not available in Destination.
So I made okta FQDN and trial.* as destinations, but the authentication screen doesn't show up.

Do you know how to set the destination for Okta authentication?

Also, I would like to know what traffic flow okta authentication is done when users access the server.

Thank you.