This article walks through how to:
Create a device assurance policy for Windows devices
Apply it using two authentication policy rules: an allow rule and a deny rule
ROLE REQUIRED
ZeroTek Administrator
ZeroTek Technician
BEFORE YOU BEGIN
Before proceeding, review Okta device assurance policies for an overview of how device assurance works.
ZeroTek recommends creating an Okta test group to validate device assurance in your environment before extending it to a larger group of users. Like device trust, device assurance is best deployed incrementally and strategically.
1️⃣ Create the device assurance policy
The example policy in the procedure below restricts access to devices running Windows 11 at the latest supported major version, and displays remediation instructions to users whose devices are not in compliance.
Deep Link into the target org's Okta Admin Console.
Navigate to Security > Device Assurance Policies.
Click Add a policy.
Enter a name for the policy (e.g. Device Assurance - Windows).
For Platform, select Windows.
In the Windows section, configure the following:
Windows 11 version: Select Must be at least > Latest supported major version, and check Must be up-to-date with security patches.
Windows 10 version: Select Not allowed.
Lock screen: Select Windows Hello must be enabled.
Disk encryption: Select Device disk must be encrypted.
Trusted Platform Module: Select Device uses a Trusted Platform Module.
In the Custom posture checks section, confirm Posture checks is set to None.
In the Remediation section:
Select Display remediation instructions to show non-compliant users how to remediate their device.
Under Grace period, set Grant users time to remediate issues to Yes, after a number of days, and enter 1.
Click Save.
2️⃣ Apply the policy using policy rules in the default "Any two factors" authentication policy
Device assurance policies take effect through rules in an authentication policy; in this case, the "Any two factors" policy. You will create two rules: one to allow compliant devices and one to deny non-compliant devices.
Navigate to Security > Authentication Policies.
Click App sign-in, then click Any two factors.
Create the allow rule
Click Add rule.
Name the rule (e.g. Device Assurance - Windows - Allow).
In the IF section:
For User's group membership includes, select any groups you are using to manage device assurance rollout, if applicable.
For Device state is, select Registered.
For Device assurance policy is, select the Windows device assurance policy you created in Step 1.
In the When to prompt for authentication section, set Prompt for authentication to When an Okta global session doesn't exist.
Click Save.
Create the deny rule
Click Add rule.
Name the rule (e.g. Device Assurance - Windows - Deny).
In the IF section, for Device assurance policy is, select the same Windows device assurance policy.
In the THEN section, set access to Denied.
Click Save.