Configure Device Management for mobile devices

When an app sign-in policy requires devices to be managed, Okta determines the management status of the targeted Android and iOS devices. Okta checks whether there's a key installed on the device. This key must match a key you generated on the Admin Console and entered in your MDM software's managed app configuration.

This procedure works the same way in production and preview orgs, with a few differences called out in the following steps.

Start this procedure

1. In the Admin Console, go to Security > Device integrations.

2. Click the Endpoint management tab. In preview orgs, this tab is named Management attestation.
3. Click Add platform. In preview orgs, this button is named Create app hint. If you add more than one configuration for the same type of platform, see Devices known issues and workarounds.
4. Select Android or iOS as applicable.
5. Click Next. This step doesn't apply in preview orgs, where platform selection and app hint configuration happen on a single page.
6. Configure the management attestation:
   1. To use a new secret key, keep the default setting. If you already have a secret key that you want to use, select Use existing key.

   2. If you use a new key, Okta generates it for you.

      If you use an existing key, enter it in the Secret key field. Ensure that the key was previously generated by Okta or meets these requirements:

      • It has 8-256 alphanumeric characters.

      • It's a mix of uppercase and lowercase letters and symbols.

   3. Copy the provided secret key to your clipboard by clicking the copy icon next to the field. You enter the secret key later in your MDM software's app configuration as described in Integrate Okta with your MDM software.
      Note:

      Make a note of the provided secret key value as this is the only time it appears in Okta. If you generate a new secret key by clicking Reset secret key, make sure to also update your MDM software configuration with the new key.

      The Device management provider field is pre-populated with the name of your MDM software but you can change it. The contents of this field are displayed to end users later when they enroll their device.

   4. In the Enrollment link field, enter a web address for redirecting end users with unenrolled devices. For example, redirect users to enrollment instructions or the page of your MDM software (assuming the MDM software supports web-based enrollment).
   5. Click Save. In preview orgs, you're also asked Trust this app hint for Management Attestation? before you save.

What to do next

In preview orgs, select Yes, trust this app hint for Management Attestation now or Not now at the trust prompt. If you select Not now, the app hint isn't used for management attestation. If an app sign-in policy requires management attestation, users with devices verified by this app hint are denied access until you trust the app hint for management attestation.