ROLE REQUIRED
ZeroTek Administrator
ZeroTek Technician
Before proceeding, review Okta device assurance policies for an overview of how device assurance works.
ZeroTek recommends creating an Okta test group to validate device assurance in your environment before extending it to a larger group of users. Like device trust, device assurance is best deployed incrementally and strategically.
Overview
This article walks through how to:
Create a device assurance policy for macOS devices
Apply it using two authentication policy rules — an allow rule and a deny rule
This example policy restricts access to devices running macOS Tahoe at the latest supported major version, and displays remediation instructions to users whose devices are not in compliance.
Step 1: Create the device assurance policy
Log into the target org's Okta Admin Console.
Navigate to Security > Device Assurance Policies.
Click Add a policy.
Enter a name for the policy (e.g. Device Assurance - Mac).
For Platform, select macOS.
In the macOS section, configure the following:
OS version: Select Must be at least > Tahoe.
Lock screen: Select Password must be set.
Disk encryption: Select Device disk must be encrypted.
Secure Enclave: Select Device supports Secure Enclave.
In the Remediation section, configure remediation options as needed. Refer to Okta documentation for details: Configure custom remediation instructions for device assurance.
Click Save.
Step 2: Apply the policy using authentication policy rules
These rules must be added to the default Any two factors authentication policy.
Navigate to Security > Authentication Policies.
Click Any two factors.
Create the allow rule
Click Add rule.
Name the rule (e.g. Device Assurance - macOS - Allow).
In the IF section:
For User's group membership includes, select any groups you are using to manage device assurance rollout, if applicable.
For Device state is, select Any.
For Device assurance policy is, select the macOS device assurance policy you created in Step 1.
In the When to prompt for authentication section, set Prompt for authentication to When an Okta global session doesn't exist.
Click Save.
Create the deny rule
Click Add rule.
Name the rule (e.g. Device Assurance - macOS - Deny).
In the IF section, for Device assurance policy is, select the same macOS device assurance policy.
In the THEN section, set access to Denied.
Click Save.