Migrate from Device Trust to Okta FastPass

No. First, upgrade from Classic Engine. Then, configure the new Device Trust and Okta FastPass settings in Identity Engine.

Device Trust (Classic Engine) uses Okta Mobile to attest that a mobile device is trusted and managed. Identity Engine doesn't support Okta Mobile, so end users can no longer use it to access their apps. Instead, users can access their apps from the Okta End-User Dashboard in a mobile browser.

Device Trust enables device management. In Classic Engine, Device Trust is established by the presence of certificates and has a strong dependency on Jamf (for macOS) and Active Directory (for Windows). In Identity Engine, Device Trust still works with certificates, but it uses Okta Verify and works across all MDMs. An endpoint management tool (for example, Jamf Pro Workspace ONE) manages devices before end users can access Okta-managed apps. Okta FastPass enables passwordless authentication. You combine Device Trust with Okta FastPass to obtain strong passwordless authentication on managed, compliant devices.

Okta Verify registers the device in the Universal Directory. Okta Verify detects the presence of management certificates on the device to attest that a device is managed or trusted. The latest version is required for Okta FastPass.

See Okta Device Trust solutions on a Classic org.

You can ask your Okta account team to revert your Identity Engine org back to a Classic Engine org. After you revert to a Classic Engine org, push and TOTP remain enabled even if these factors weren't enabled on your Classic Engine org before the upgrade. You can deactivate Okta Verify in your org. Go to SecurityMultifactorFactor Types, select Okta Verify, and then select Deactivate.

Since IWA was used for Device Trust in Classic Engine, IWA agents stay in place until certificates are issued from the new platform:

1. In Identity Engine, go to SecurityDevice Integrations and configure the platform.
2. Configure a new Certificate Authority (CA).
3. Go to your device management software to deploy the new certification to all devices.
4. Deploy Okta Verify to all devices.
5. Remove the IWA agents.
6. Remove the Classic Engine platforms.
7. Don't revoke the Classic Engine certificate from the end-user devices.

The certificate works until you install Okta Verify on end-user devices and the users register their account by using the Okta Verify desktop application. After users create the Okta Verify account, the Certificate Authority requires the new certificate.

The existing certificate continues to work until the users install and register Okta Verify on their devices. Users can't access apps if they must use a trusted device but don't have the new certificate.

Yes, you can. However, Okta recommends that you move away from IWA and use Device Integration instead to use the new features.

Okta allows this to continue our customers to function while moving to the new platform.

No, but Okta requires pushing the new certificates before pushing Okta Verify to your devices. If you don't follow this sequence, users lose access to applications protected by Device Trust.

Yes, Okta uses the old certificate until you install and register Okta Verify on the device.

Yes. Perform the following steps to deploy Identity EngineDevice Trust after your upgrade:

1. Set up the SCEP URL.
2. Use your endpoint management solution to ensure that certificates are pushed to the devices.
3. Ensure that the devices have Okta Verify.
4. Enforce app policies.
5. Validate Identity EngineDevice Trust.
6. Decommission Classic EngineDevice Trust.

No reconfiguration is required in Jamf.

Okta Verify continues to work as expected. This is relevant if you've configured Jamf Connect to prompt reauthentication for certain actions like reboot.

YubiKey and WebAuth don't work in Jamf Connect after upgrading to Identity Engine, because Jamf Connect doesn't support these authenticators.

If you configured YubiKey or WebAuthN, configure Okta Verify after the upgrade.

No. The Python script, also known as Okta Device Registration Task, is no longer required in Identity Engine.

Identity EngineDevice Trust uses a keychain. Re-enroll the keychain if it gets cleared.

You can use endpoint management solutions to push the certificates and validate.

Configure the new CA and issue certificates using the new CA. Identity Engine platform supports configuring multiple CA and endpoint management solutions. The existing CA doesn't require reconfiguration.