Device Posture Sensor Mode

The primary goal of Device Posture Sensor Mode is to decouple device registration from user enrollment. It's engineered specifically for admins who need to monitor and enforce device security policies across their org without creating user friction.

How it works

IT admins configure Device Posture Sensor Mode and register the devices through their Mobile Device Management (MDM) solution. After devices establish a sensor state using a device-level certificate, admins can then monitor the health of shared or kiosk devices and ensure that Okta FastPass enrollment is restricted exclusively to trusted, managed endpoints.

This feature relies on the following principles:

Decoupled registration

Device registration is separated from user enrollment. The device registers automatically upon startup after MDM deployment.

Simple Certificate Enrollment Protocol profiles

Simple Certificate Enrollment Protocol (SCEP) is a standard used to automate the issuance of digital certificates to devices. Okta Verify uses these certificates to prove a device is managed during authentication. This process is designed to be silent and automatic for users.

MDM configuration

Admins deploy the Okta Verify client for macOS or Windows with specific configuration parameters. These configuration parameters are required to enable silent device-only registration.

Policy enforcement

After registering the device, Okta can gather device-level posture signals and enforce Device Assurance policies during an authentication challenge, even if the user hasn't enrolled in Okta FastPass.

Device signals can be sent from the device even when Okta FastPass isn't enabled or assigned to users.

Get started

1. Configure macOS and Windows configuration parameters for your Okta Verify clients. Use your MDM solution to push the updates to your client machines.

   • Windows

     Device Posture Sensor Mode is available in Okta Verify for Windows version 6.12 or later.

     1. Add both the AutoRegistration and OrgUrl configuration options as command-line options to your Okta Verify installer.
        Set the AutoRegistration value to DEVICE and the OrgUrl to your Okta org. For example:

        OktaVerifySetup.exe AutoRegistration=DEVICE OrgUrl=https://{yourorg}.okta.com/

     2. When you configure Sensor Mode for a shared device, add the EnrollmentOptions option with a value of Disabled.

        However, if you plan to enroll a device in Okta FastPass, set the EnrollmentOptions option to Enabled.

   • macOS

     Device Posture Sensor Mode is available in Okta Verify for macOS version 9.65 or later.

     1. Add the OktaVerify.AutoRegistration configuration option to your .plist file. Set the string value to DEVICE.
     2. Add the OktaVerify.OrgUrl configuration option to your .plist file. Set the value to the URL for your Okta org.
     3. When you configure Sensor Mode for a shared device, set OktaVerify.EnrollmentOptions option to Disabled.

        However, if you plan to enroll a device in Okta FastPass, set OktaVerify.EnrollmentOptions to Enabled.

2. Use your MDM to set up device certificates.

   • If you want to use Okta as your Certificate Authority, see Use Okta as a CA for Device Access and follow the guide that matches your MDM platform and client operating system.
   • If you want to use your own Certificate Authority, see Use your own CA for Device Access.

   Deploy your changes and then verify your device certificates.

3. If you want to enforce the managed condition for devices, use your MDM to set up a management certificate.

   • If you want to use Okta as your Certificate Authority, see Configure Okta as a CA and follow the guide that matches your MDM platform and client operating system.
   • If you want to use your own Certificate Authority, see Provide your own CA.
4. Check device registration in Okta Verify.
5. Create and enforce the registered device policy.
6. Enforce managed condition during enrollment.
7. Finally, to verify the device registration, you can check the System Log for entries labeled Bind client certificate and Create device enrollment at the time of registration.

End user experience

With Device Posture Sensor Mode, if you have configured devices to always start the Okta Verify app, then end users don't need to open or interact with the Okta Verify app to register the device for signals.

Users can't unregister the device.

If Device Posture Sensor Mode registration fails in Okta Verify, end users receive a short error description. They can then report this error message to their help desk.