What is Okta Device Access?
Okta Device Access (ODA) extends Okta Workforce Identity Cloud to endpoint operating systems across macOS and Windows.
Organizations can require identity verification during initial device enrollment or zero-touch provisioning. The user must complete the verification before they can bind the device, create local account credentials, or access enterprise resources. Common enrollment paths include Jamf Pro, Jamf Connect, Microsoft Intune, Windows Autopilot, and Apple Automated Device Enrollment (macOS Setup Assistant).
ODA uses the standard Okta web-based sign-in flow directly on the endpoint for enrollment. This flow applies the Account Management Policy that already controls the sign-in of that user. Thus, the Persona standard Okta integration with OAMP works with Okta Device Access enrollment with no added configuration. It does not require custom desktop plugins or external agents.
Use cases
- Remote employee onboarding: Your company can ship high-value corporate hardware directly to a remote hire. Prevent an unauthorized person from intercepting, configuring, or compromising it.
- Privileged endpoint issuance: Require step-up biometric verification when you provision devices for administrators or high-security roles.
- Contractor and BYOD access: Require a verified government ID before a user can access a corporate desktop or enroll a management profile.
- Endpoint account recovery and Desktop MFA: Verify employee identity again for account recovery workflows, or for elevated lock-screen re-authentication on current workstations.
How it works
- Enrollment trigger: A user turns on a laptop that is not provisioned. On macOS, Platform Single Sign-On gives the setup session to Okta. On Windows, Autopilot gives the initial sign-in to Okta.
- Sign-in widget: The standard Okta web-based Sign-In Widget shows directly in the endpoint setup flow. It applies the Account Management Policy that already controls the sign-in of that user.
- Embedded verification: Persona is an Identity Provider (IDV) authenticator on that policy. Thus, Okta sends the user to Persona. The user verifies their government ID and takes a selfie. This occurs before the system creates local credentials or device profiles.
- Provisioning completion: Persona validates the user and sends the verification claim back to Okta. Okta then lets the enrollment agent complete device binding and issue desktop tokens.
Prerequisites
Before you configure Okta Device Access with Persona:
- Make sure that your Okta tenant uses Okta Identity Engine (OIE) and has Okta Device Access enabled.
- Configure Persona as an Identity Verification Provider in Okta. For instructions, read Configure Persona for the Okta Account Management Policy.
- Create an Inquiry Template for employee onboarding. The template must collect a government ID and a live selfie.
Configure your Persona Inquiry Template
When you configure the Inquiry Template for Okta Device Access, we recommend that you enable Use native mobile app flow. With this setting, users complete verification on their mobile device.
During the first setup of a new machine, the operating system runs Okta in a locked-down, embedded system webview, not in a full browser. These closed environments cause problems for verification on a desktop:
- No camera permissions: Locked-down provisioning webviews may block access to the camera. Then users cannot capture an ID or take a selfie with the laptop webcam.
- Biometric degradation: Laptop webcams do not have the resolution, focus control, and dynamic range of smartphone cameras. This increases verification friction and the number of users who stop.
- Sandbox constraints: Provisioning webviews frequently limit file uploads and local session storage.
Use native mobile app flow prevents these limits. It sends the user to their mobile device to complete verification.
- In the Persona Dashboard, go to Inquiries > Templates. Open your employee verification template.
- In the upper corner of the Flow Editor, click Configure.
- Under the Device handoff tab, enable Use native mobile app flow.
- Save and publish your template changes.
Connect your MDM to Okta Device Access
Okta Device Access does not add a separate identity-verification rule to Authentication Policies. Instead, connect your device enrollment tool to Okta. The tool then sends the user to the Account Management Policy that you already configured with the Persona IDV authenticator.
- In your MDM, configure the device enrollment profile to use Platform Single Sign-On or Okta Device Access. Point the profile to your Okta org. Examples of an MDM are Jamf Pro or Jamf Connect on macOS, and Microsoft Intune on Windows.
- Assign your new-hire or device-provisioning user groups to the Account Management Policy that requires the Persona IDV authenticator. For more information, read Configure Persona for the Okta Account Management Policy.
- Deploy the enrollment profile to your device-provisioning device groups.
End-user enrollment flow
- Power on machine: The employee turns on their new laptop and connects to Wi-Fi.
- Setup prompt: The operating system starts Apple Automated Device Enrollment, Jamf Connect, or Windows Autopilot. It tells the employee to sign in with Okta.
- Identity verification: Okta prompts the employee to verify their identity with Persona.
- Mobile handoff: Persona shows a QR code on the laptop screen. The employee scans the code to open the verification flow on their smartphone. On iOS, the flow opens in an App Clip with no install. On Android, the flow opens in the Persona Wallet app.
- ID and selfie capture: The employee captures their government ID and takes a live selfie on mobile.
- Machine unlocks: Persona confirms the verification with Okta. The laptop screen automatically goes to the next step. The enrollment agent then creates the local account and completes device provisioning.
Troubleshooting
Webcam or camera does not launch on the laptop screen
The locked-down provisioning environment (Windows OOBE or macOS Setup Assistant) may have blocked camera permissions. In your Persona Inquiry Template, enable Use native mobile app flow under the Device handoff tab. Employees then verify on a mobile device, not with the laptop webcam.
Session times out during laptop setup
After the identity verification step starts, Okta gives a standard 10 minutes to complete it. If an employee takes too long to find their ID or complete the mobile flow, the session expires. Tell the employee to start the enrollment step again. This generates a new session and QR code.
Plans Explained
Okta Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Okta Integration | Not Available | Not Available | Limited | Available |