Okta device assurance verifies that a user's device meets specific security and compliance requirements before granting access to applications. It is configured using device assurance policies, which define the minimum security posture a device must meet.
What does device assurance check?
A device assurance policy can check whether a device:
Is managed by an approved system (such as Intune, Jamf, or if it is registered in Okta Verify)
Has up-to-date OS and security patches
Is encrypted
Has screen lock enabled
Meets other compliance or management conditions
How does it work?
Device assurance policies are applied to rules within Okta authentication policies. When a user signs in, Okta evaluates their device against the defined conditions. If the device meets the requirements, access is granted. If not, the user is blocked or prompted to remediate their device.
Key benefits
Improved security — Restricts access from unmanaged or non-compliant devices.
Zero Trust support — Enforces identity and device context together at sign-in.
Seamless experience — Integrates with Okta FastPass for passwordless sign-ins.
Granular control — Supports different assurance policies for different apps or user groups.
Prerequisites
Before creating and applying a device assurance policy:
The org must be configured to use Okta FastPass, which ensures Okta Verify is installed on all relevant devices. See the Okta FastPass Setup guide.
ZeroTek recommends creating an Okta test group to validate device assurance in your environment before rolling it out more broadly. Like device trust, device assurance is best deployed incrementally. See the Okta Device Trust Setup guide.