Adding Okta Device Trust for Mac & Windows with Workspace ONE

Note: Please see my updated blog on Factor-Base Device Trust: https://theidentityguy.ca/2020/12/03/factor-based-device-trust-with-vmware-and-okta

If you have read my previous blog on configuring Configuring Device Trust, you will know that Okta has not yet implemented device trust for Windows and MacOS. I also mentioned in the previous blog that if you want to leverage device trust for Windows and MacOS that you will need to use the original method with just routing rules.

In my previous blog I didn’t go into the details on how you would configure device trust for both IOS/Android and Windows/MacOS. Its not really as straight forward as you would think because once you have configured an Identity Provider in Okta to use device trust, it will always send the device trust authentication context which will always result in an authentication failure for Windows and MacOS (assuming its being evaluated for Certificate and Device Compliance – AirWatch).

Note: This blog will not go into steps to configure Workspace ONE UEM or Workspace ONE Access to perform Certificate Based Authentication. We will assume that this has already been done.

There are a couple extra steps you will need to do.  Lets walk through the steps.

Create a New Identity Provider

First you will need to create another Identity Provider for Workspace ONE.

  1. Log into the Okta Administration Portal and go to Security -> Identity Providers
  2. Click Add Identity Provider -> Add SAML 2.0 IDP
  3. Configure this Identity Provider exactly as you’ve configured the previous one
  1. Click on Show Advanced Settings
  2. Make sure the Request Authentication Context is set to None
  1. Click Add Identity Provider
  2. Expand the Identity Provider you just created and download the metdata

Create a new Workspace ONE Application for Okta

  1. In Workspace ONE Access, got to Catalog and Click New
  2. Provide a name for this application (ie. Okta Device Trust for Windows/MacOS)
  3. Paste the metadata you downloaded in the previous step.
  4. Click Next, Next, Save
  5. Click Edit for the application you just created
  6. Click Configuration
  7. Modify to the username value to match the username format in Okta.
  1. Click Access Policies
  2. Select the same policy you assigned to the Okta Application Source
  1. Click Next – Save
  2. Assign the application to your users.
  3. Click on Identity and Access Management -> Policies
  4. Edit your Okta Policy
  5. Create a Policy Rule for MacOS to use Certificate and Device Compliance.

Modify your Routing Rules in Okta

Finally, we can now add this new configuration into the routing rules in Okta

  1. Log into the Okta Admin Console
  2. Click on Security -> Identity Providers
  3. Click on Routing Rules
  4. Click Add Routing Rule
  5. Add a rule that will evaluate Windows and MacOS for your required applications and select the new “Workspace ONE – No Device Trust” identity provider we created in the first step.
  1. Verify that there are no other rules that will take precedence over your newly created rule.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s