Enforce managed condition during enrollment

Enforce the managed condition during device enrollment.

  1. Enable the OAMP device conditions EA feature.
    1. In the Admin Console, go to Settings > Features.
    2. Enable the Use device conditions in the Okta account management policy EA feature.
  2. Create an Okta Account Management Policy (OAMP) with registered and managed condition requirements.
    1. In the Admin Console, go to Security > Authentication Policies > Okta account management.
    2. Add a rule with the following conditions:
      IF
      Device state is Registered
      Device management is Managed
      The following custom expression is true: 
      accessRequest.operation == 'enroll' && accessRequest.authenticator.key == 'okta_verify'
      THEN
      Access is allowed after successful authentication
      User must authenticate with any enrolled authenticator that isn't FastPass
  3. Create an enrollment policy for a test user that requires FastPass enrollment.
    1. In the Admin Console, go to Security > Authenticators > Enrollment.
    2. Add a policy and set Okta Verify enrollment to Required.
  4. Check that the test user account satisfies the OAMP policy.
    1. Sign in to the Okta End-User Dashboard as your test user.
    2. Enroll in Okta Verify.
      Confirm that your user satisfies the OAMP requirements for registered and managed account.