Device assurance management

Understand device assurance management tool scopes, features, and capabilities, with sample workflows and example prompts.

Early Access release

Tool name

okta_device_management

Okta scopes

okta.deviceAssurance.read and okta.deviceAssurance.manage

What you can do

• List all device assurance policies
• Retrieve a device assurance policy configuration
• Create a new device assurance policy
• Replace an existing device assurance policy
• Delete a device assurance policy
• Support multiple platforms, including Android, iOS, macOS, Windows, and ChromeOS
• Enforce device requirements during authentication
• Provide read and write access
• Restrict actions based on your granted OAuth scopes

Sample use cases

Use case	Prompt	Result
Before letting employees access business apps from Windows devices, the admin wants a device assurance policy that only passes if the device uses a biometric screen lock and has disk encryption enabled, so weakly protected or unencrypted machines are blocked.	Add a device assurance policy named Windows Security Baseline for Windows requiring a biometric screen lock and disk encryption.	The Windows Security Baseline device assurance policy is created for Windows requiring a biometric screen lock and disk encryption, and the created policy is shown so you can confirm the settings.
Before letting contractors reach sensitive apps from Macs, the admin wants a device assurance policy that only passes if the Mac has disk encryption on and is running a recent macOS version, so out-of-date or unencrypted machines are blocked.	Create a device assurance policy named 'Mac Contractor Baseline' for the macOS platform that requires disk encryption to be enabled and a minimum OS version of 14.0, then show me the created policy so I can confirm its settings.	The 'Mac Contractor Baseline' device assurance policy is created for macOS requiring disk encryption and macOS 14.0 or later, and the created policy is shown so you can confirm the settings.