When a device configured with Okta Device Trust shows up as "Unmanaged" in Okta, and SCEP certificate enrollment fails, it may be due to an expired Azure App Registration secret. This article explains how to confirm the issue and resolve it by renewing the secret.
Symptoms
Devices that should be managed through Okta Device Trust appear as Unmanaged in the Okta Admin Console.
In Event Viewer on the affected device (Event Viewer > Applications and Services Logs > Microsoft > Windows > Device Management-Enterprise-Diagnostics-Provider), the following errors may appear:
Event ID 32
SCEP: Certificate enroll failed. Result: (Unknown Win32 Error code: 0x87d00905)
In Microsoft Intune, under Devices > [Device] > Device configuration, the SCEP profile (e.g., Okta SCEP Device Trust ) is listed with a Failed status.
Cause
This issue typically occurs when the client secret for the Azure App Registration used by the Okta Device Trust integration has expired. Azure App Registration secrets expire after 730 days by default unless configured otherwise.
Resolution
To resolve this issue, generate a new client secret in Azure and update the integration in Okta:
Step 1: Create a new client secret in Azure
Go to Azure portal > Azure Active Directory > App registrations.
Select the application (e.g., Okta Endpoint Management).
Under Manage, select Certificates & secrets.
Click + New client secret.
Enter a description (e.g.,
Renewal 2025) and set the expiration to the maximum 24 months (730 days) or as appropriate.Click Add and copy the newly generated Value. You will not be able to retrieve it again.
Step 2: Update the secret in Okta
In the Okta Admin Console, go to Security > Device Integrations > Endpoint Management.
Select the appropriate integration profile for Device Trust.
Locate the field for Azure client secret and paste the new value.
Click Save.
Step 3: Validate device enrollment
On a test device, force a sync or reboot.
Monitor Event Viewer and Intune for successful SCEP enrollment.
Confirm the device now appears as Managed in the Okta Admin Console.
BEST PRACTICES
Set reminders to rotate client secrets before expiration.
Use a password vault to securely store the client secret value.
Maintain documentation with secret creation and expiration dates for each tenant.
Always test secret changes on a non-critical device.