View macOS device details
Review the accounts, configurations, signals, and identifiers shown for macOS devices when you enable the Device Visibility feature.
Device Visibility
Early Access release. See Enable self-service features.
The device details page for macOS devices uses a four-tab layout when you enable the Device Visibility feature: Accounts, Configurations, Signals, and Identifiers.
If you don't have the Device Visibility feature enabled, macOS device details use a different view.
The main header for this page shows the Device display name and the device's operating system (OS). Also shown are the device's current state and the action buttons to change the device state.
Select View logs to open the System Log filtered to show only the events for this device.
Accounts tab
The Accounts tab shows the macOS user accounts and Okta user enrollments on the device.
Users with a known OS account
These are the OS-level user accounts detected on the device.
For account and Platform SSO (PSSO) information to appear here, macOS devices must be using version 9.69 or later of the Okta Verify app.
All detected OS accounts appear here if they're enrolled in Okta Device Access. This enrollment can be through PSSO 1.0, PSSO 2.0, or Desktop MFA.
However, for accounts without a PSSO 2.0 enrollment, the Okta user column shows a dash and no PSSO card is shown. This is true even if the account is enrolled through PSSO 1.0 or Desktop MFA. Instead the account appears in the Okta Verify accounts section.
Each row in the Accounts table shows the following:
| Column | Description |
|---|---|
| Operating system user | The name of the OS user account as it appears on the device. |
| Okta user | The Okta user linked to this OS account through Platform SSO 2.0. If the OS account has no PSSO 2.0 enrollment, this column shows a dash. |
| Management | Managed or Unmanaged. This indicates whether a device management solution manages the user profile associated with this device enrollment. |
| Last seen | The date when Okta last received OS account data from this device. The table is sorted by this column by default. |
Select a row to view the following account details and authenticator enrollment cards.
| Detail | Description |
|---|---|
| Account universally unique identifier (UUID) | The unique identifier for this OS account on this device. This value is specific to the account-device combination and differs from the Okta Device ID. |
| Lock screen | The method that the user most recently used to unlock this device. For example, Password with Touch ID. |
Platform SSO enrollment card
If the OS account has a PSSO 2.0 enrollment, a PSSO card appears in the expanded row.
| Field | Description |
|---|---|
| Authenticated on | The date and time of the most recent PSSO authentication for this account. |
| Enrolled on | The date and time the PSSO enrollment was created. |
| Authentication method | The authentication method configured for this PSSO enrollment. For example, Password or Secure Enclave. |
| User | The Okta user associated with this PSSO enrollment. Select the user to open the user profile in the Admin Console. |
Okta FastPass enrollment card
If an OS account row has a linked Okta user, an Okta FastPass enrollment card appears for each Okta FastPass enrollment associated with that user on this device.
| Field | Description |
|---|---|
| Enrolled on | The date the Okta Verify enrollment was created on this device for this user. |
| User | The Okta user associated with this Okta FastPass enrollment. Select the user to open the user profile in the Admin Console. |
Device-bound session card
If the OS account has an active device-bound session, a Device-Bound SSO (DBSSO) card appears in the expanded row, showing the factors that established the session, each with a last-used date, and a View logs link. If more than two factors established the session, select View all factors to see all of them in a popup.
If the device isn't registered for Platform SSO, the card shows Check Device Capabilities instead. The card is informational only. To see which capabilities are provisioned, review the Device Capabilities section on the Configurations tab. To set up Device-Bound SSO, see Configure Device-Bound SSO for macOS.
Users without a known OS account
These users have Okta FastPass and Okta Desktop MFA enrollments on the device that aren't linked with a detected OS account.
| Field | Description |
|---|---|
| Okta user | The Okta user linked to this account. |
| Enrolled on | The enrollment date for this user account on this device. |
| Management | Indicates whether a device management solution manages the user profile associated with this device enrollment.
|
| Lock screen | The method that the user most recently used to unlock this device. |
| Recovery PIN | For managed accounts, you can generate a recovery PIN for Okta Device Access. |
Configurations tab
The Configurations tab shows the Okta Verify installation details reported from this device. Each installed component appears as a separate card.
If Okta Verify hasn't reported data for this device, an informational notice appears in place of the configuration cards. Okta Verify sends signal data approximately every three hours after Device Visibility is enabled.
| Card | Description |
|---|---|
| Version | The version of Okta Verify installed on the device.
Select Download latest version to open the download page. |
| Okta Verify authenticator | Indicates that the Okta Verify authenticator is installed. Select Authenticator settings to open the authenticator configuration in the Admin Console. |
Device Capabilities
The Device Capabilities section shows the active Okta-managed capabilities on this device. Each capability shows Provisioned or Not provisioned, or is omitted if it doesn't apply.
| Capability | Description |
|---|---|
| Desktop MFA Recovery PIN | Shows Provisioned if a recovery PIN secret exists in Okta for this device, indicating that a recovery code is available for admin use. |
| Platform SSO | Shows Provisioned if the device's Platform SSO registration exists in Okta. |
| Device-Bound SSO | Shows Provisioned using the same criteria as Platform SSO. |
| Device Posture Sensor Mode | Shows Provisioned if the device has a valid registration and the device instance key is registered with Okta. |
Signals tab
The Signals tab shows the device security attributes that Okta Verify collects.
| Signal | Description |
|---|---|
| OS version |
The operating system version installed on the device. |
| Disk encryption |
Indicates whether the device storage is encrypted. This reflects FileVault status. The device is marked as encrypted only when encryption is active and enabled on the system volume. For example: All internal volumes encrypted. |
| Secure Enclave |
Indicates whether the device has a Secure Enclave processor. For example: Supported. |
Identifiers tab
The Identifiers tab shows hardware and platform identifiers for the device.
The Hardware Universally Unique Identifier (UUID) field replaces the UDID (Unique Device Identifier) field from earlier Admin Console versions. Devices registered before this change may still display UDID.
| Identifier | Description |
|---|---|
| Okta Device ID | The unique identifier assigned to this device by Okta. |
| Display name | The display name of the device. |
| Manufacturer | The vendor that created the physical device. |
| Model | The device type or design. |
| Serial number | The hardware serial number of the device. |
| Hardware Universally Unique Identifier (UUID) | The hardware-level unique identifier for the device.
This field was previously named the device UDID. |