Setting up Okta Device Trust with Workspace ONE UEM

Okta is updating their identity platform and moving away from the Okta Classic Engine to the Okta Identity Engine. With this update, the way that Device Trust is configured has completely changed. The updated device trust now relies upon the MDM deployment of the Okta Verify app deployed with a specific Application Configuration containing a key generated from the Okta console. If the key from the console matches the key stored in the app on the device, the device must be enrolled (otherwise, how would it have received the matching key) and the device is considered trusted.

Add Okta Verify as an authenticator

1. In the Okta console, go to Security > Authenticators
2. Under Setup, click Add Authenticator
3. Select Okta Verify and configure the required options

Create an enrollment policy (or edit the default)

1. In the Admin console, to go Security > Authenticators
2. Under Enrollment, add a new policy (or edit an existing one)
3. In the Eligible Authenticators section, select one of the following Okta Verify options:

• Optional: New and existing users can choose to enroll in Okta Verify as an authenticator. Okta Verify enrollment is not mandatory.
• Required: New and existing users must enroll a device in Okta Verify to access Okta-protected resources

Configure Okta endpoint management for mobile devices

1. In the admin console, go to Security > Device Integrations
2. On teh Endpoint managmenet oage, click Add Platform
3. Select Android or iOS and click Next
4. In Configure management attestation click Copy next to the secret key
5. Enter Workspace ONE as the Device management provider
6. For the enrollment link, enter https://getws1.com
7. Click Save

Integrate Okta with Workspace ONE UEM

1. In the Workspace ONE UEM console, Add the Okta Verify application and assign it to the appropriate devices
2. In the Restrictions setting, select Make App EMM Managed if User Installed.
3. In the Application Configuration settings, enter the Token copied above

Android

iOS

Create authentication policies

1. In the Okta console, go to Security > Authentication Policies
2. Click Add a policy and create a name (eg MDM Enrolled)
3. Click Add Rule and create rule for MDM enrolled (managed) devices. Device state setting should be Registered and device management state should be Managed
4. Platform should be iOS and Android
5. Access should be allowed
6. Click save
   
   
   
   
   
7. Create a second rule for non-mobile devices to allow access. These devices do not need to be managed
   
   

   
   
   
8. Update the catch-all rule to deny access for all other scenarios

Assign Policies to the applications

1. In the console, to go Security > Authentication Policies > [Policy created above]
2. Select Applications
3. Select Switch Policy for each application that you would like to enforce device trust (or Add App if no applications are listed) and select the created policy. Do not apply this policy to WS1 Access since (if using Access as Source of Authentication) this is used for device enrollment and you will end up in a chicken/egg situation.

Configure the SSO Extension for iOS (Optional)

Deploy the SSO Extension profile to iOS devices with the appropriate settings

Extension identifier: com.okta.mobile.auth-service-extension

Type: Credential

Realm: Okta Device

Hosts: Your Okta tenant

Certificate: None

Custom XML: <dict><key>managementHint</key><string>[Token goes here]</string></dict>