Create and enforce the registered device policy

Enforce the registered condition and the Device Assurance policy during the sign-in flow with multiple users.

  1. Create a Device Assurance policy for macOS or Windows:
    1. In the Admin Console, go to Security > Device Assurance Policies.
    2. Select Add a policy.
    3. Create a macOS or Windows policy with conditions that your devices pass.
  2. Create an app sign-in policy that contains a registered condition requirement.
    1. In the Admin Console, go to Security > Authentication Policies > App sign-in.
    2. Select Create policy.
    3. Set the catch-all policy to Denied.
    4. Add a rule with the following conditions:
      IF
      Device state is Registered
      Device management is Managed
      Device assurance policy is the policy created in the previous step.
      THEN
      Access is allowed after successful authentication
      User must authenticate with any enrolled authenticator that isn't FastPass
  3. Sign in to the app where the authentication policy is assigned.
    1. Assign the app sign-in policy to the Okta End-User Dashboard app.
    2. To test the access for a test user, access the Okta End-User Dashboard.
    Confirm that you can access the Okta End-User Dashboard without error.
  4. As a different test user, sign in to the app where the authentication policy is assigned.
    1. On the same device, switch to a different user account.
    2. Access the Okta End-User Dashboard app as the different user.
    Confirm that you can access the Okta End-User Dashboard without error.