Device lifecycle

An Active device can be:

• Suspended
• Deactivated

From an Active device, a user can access protected resources if permitted by the App Sign On policies applied to the resources.

A Suspended device can be:

• Unsuspended, which returns it to an Active state.
• Deactivated

Only Deactivated devices can be activated. Activate is only available on the Devices page and Device Profiles page of Deactivated devices.

When a device is activated:

• All Okta Verify factors associated with the device are supported.
• Users can access protected resources from the device, if permitted by the authentication policies applied to the resources.

A Suspend and Deactivate button is located:

• On the Devices page of the active device.
• In the Device Attributes page of the active device.

Only Active devices can be suspended. Suspend is available only on the Devices page and Device Profiles page of Active devices. This is intended to be a temporary state. It is useful if you need to pause, and later resume, device access for users such as contractors or employees who take a leave of absence.

When a device is suspended:

• All active sessions that were established on that device using Okta Verify are terminated.
• Active sessions established without Okta Verify are unaffected until the session ends.
• New sessions using Okta Verify can't be established.
• Okta Verify authentication factors (for example, Okta FastPass, Okta FastPass with biometrics, temporary one-time password, and Push) can't be used from the device, but users can continue to use password, email, or WebAuthN authentication factors from the device.
• Users can't add or remove accounts from Okta Verify on the device.
• Device certificates are unaffected (applies to desktop devices).
• The device can't be unsuspended by the user trying to enroll in Okta Verify from the device.

An Unsuspend button is located:

• On the Devices page of the suspended device.
• In the Device Attributes page of the suspended device.

Only Suspended devices can be unsuspended. Unsuspend is available only on the Devices page and Device Profiles page of Suspended devices.

When a device is unsuspended:

• The device becomes Active.
• All Okta Verify factors associated with the device are unsuspended.
• Users can access protected resources from the device, if permitted by the authentication policies applied to the resources.

A Unsuspend button is located:

• On the Devices page of suspended devices.
• In the Device Attributes page of suspended devices.

Only Active devices can be deactivated. Deactivate is available only on the Devices page and Device Profiles page of Active devices.

When a device is deactivated:

• All active sessions that were established on that device using Okta Verify are terminated.
• Active sessions established without Okta Verify are unaffected until the session ends.
• New sessions using Okta Verify can't be established.
• Okta Verify authentication factors (for example, Okta FastPass, Okta FastPass with biometrics, temporary one-time password, and Push) can't be used from the device, but users can continue to use password, email, or WebAuthN authentication factors from the device.
• Users can't add or remove accounts from Okta Verify on the device.
• Enrolled factors on the device are deactivated and users must re-enroll them when the device is activated.
• Device certificates are revoked (applies to desktop devices).
• If all rules in the authentication policy protecting a resource require devices to be registered, a user on a Deactivated device is denied access to that resource (regardless of the factors they have enrolled). If the policy includes rules that allow access from unregistered devices, an end user on a Deactivated device might be able to access the resource but not by using Okta FastPass.

An Activate button is located:

• On the Devices page of the deactivated device.
• In the Device Attributes page of the deactivated device.