Configure Management Attestation for Desktop Devices

What is the purpose of Management Attestation for Desktop Devices?

To ensure that Windows and macOS desktops accessing Okta-protected apps are truly managed devices.

What verifies that a device is managed by Intune, Workspace ONE, or Jamf?

Client certificates are used to verify device management.

What does a client certificate prove?

Device authenticity and confirms management enrollment.

What are the two options for issuing certificates according to the notes?

1. Okta as the Certificate Authority (CA), 2. Bring Your Own CA.

What protocol does Okta use to issue certificates?

SCEP (Simple Certificate Enrollment Protocol) is used to issue certificates.

In the Delegated Dynamic Challenge model, who generates the unique dynamic secret?

Microsoft Endpoint Manager (Intune) generates the unique dynamic secret.

What must MEM trust to ensure secure communication with Okta?

MEM must trust the X.509 certificate issued by Okta.

What is the first step in configuring Management Attestation?

Create Azure AD App Registration for secure API communication.

What does Okta Verify do during the authentication process with certificates?

It presents the certificate to Okta to validate device management status.

What can be enforced after completing certificate issuance in authentication policies?

1. Managed device required, 2. Step-up MFA if unmanaged, 3. Block unmanaged devices from sensitive apps.

management_attestation_deck = """

What does Okta use to confirm that a desktop device is managed?

A client certificate installed on the device.

What protocol is used to issue client certificates?

SCEP (Simple Certificate Enrollment Protocol).

What are the two CA options for management attestation?

Okta as the CA or Bring Your Own CA.

Why is Okta as CA the most common option?

It simplifies PKI and certificate management.

What is a SCEP challenge?

A secret used by devices to authenticate during certificate enrollment.

What are the two SCEP challenge types?

Static challenge and dynamic challenge.

Which challenge type is more secure?

Dynamic challenge.

What is a delegated dynamic challenge?

A dynamic challenge where MEM/Intune generates the secret.

Which platforms use delegated dynamic challenges?

Windows and macOS devices managed by Microsoft Endpoint Manager (Intune).

What roles does Okta play in delegated challenge flow?

Certificate Authority and SCEP server.

What role does MEM play in delegated challenge flow?

It generates and delivers the dynamic secret.

What triggers the certificate request on a desktop?

The device receiving a SCEP profile from MEM or another MDM.

What happens after the device sends the secret to Okta?

Okta validates the secret with MEM and issues a certificate.

What happens to the dynamic SCEP secret after certificate issuance?

It expires and becomes invalid.

What is the generic dynamic challenge used for?

Devices managed by Jamf Pro or Workspace ONE.

Who generates the secret in a generic challenge?

Okta generates the dynamic secret.

What Azure configuration is required for delegated challenge?

Register an Azure AD application for Okta to communicate with MEM.

What Okta item is needed for MEM to trust the CA?

An X.509 certificate downloaded from Okta.

What profiles must be configured in MEM?

A trusted certificate profile and a SCEP profile.

How does Okta Verify use certificates during authentication?

It presents the certificate to prove that the device is managed.

What can you enforce once management attestation is enabled?

Authentication policies based on managed/unmanaged device status.

""".strip()