Configure Management Attestation for Desktop Devices

✅ OCA Study Notes — Configure Management Attestation for Desktop Devices

Management Attestation ensures that Windows and macOS desktops accessing Okta-protected apps are truly managed devices. This verification is done using client certificates.

⭐ 1. Why Certificates Matter for Managed Desktops

When a policy requires “device must be managed,” Okta must validate:

Is this device actually managed by Intune, Workspace ONE, or Jamf?

Okta confirms this by checking for a client certificate issued to the device.

A certificate:

  • Proves device authenticity

  • Confirms management enrollment

  • Enables Zero Trust conditional access decisions

This certificate check happens during FastPass authentication.

⭐ 2. Okta as a Certificate Authority (CA)

You have two options for issuing certificates:

Option 1 — Okta as the CA (Most Common)

  • Simple to deploy

  • Okta handles issuing, renewing, and revoking certificates

  • Great for orgs avoiding PKI complexity

Option 2 — Bring Your Own CA

  • More control

  • Requires managing your own PKI, CRLs, revocation, etc.

⭐ 3. How Certificates Are Issued: SCEP Protocol

Okta issues certificates using SCEP (Simple Certificate Enrollment Protocol).

Devices send a SCEP challenge (secret) to validate themselves.

There are two challenge types:

Type

Description

Static Challenge

All devices share one secret (least secure)

Dynamic Challenge

Each device receives a unique, short-lived secret (more secure)

Dynamic challenges are used for managed desktops.

⭐ 4. Two Dynamic Challenge Models

There are two dynamic challenge types, depending on the device management system.

A. Delegated Dynamic Challenge (Microsoft Intune / MEM)

Used for Windows & macOS managed by Microsoft Endpoint Manager (Intune).

Process Flow

  1. User signs into desktop

  2. Device requests a SCEP profile from MEM

  3. MEM generates a unique dynamic secret

  4. MEM pushes the SCEP profile + secret to the device

  5. Device requests certificate from Okta, presenting the secret

  6. Okta validates secret via MEM API

  7. Okta issues certificate

  8. Secret expires

Okta acts as:

  • CA (Certificate Authority)

  • SCEP Server

MEM acts as:

  • Issuer of the dynamic secret

B. Generic Dynamic Challenge (Jamf Pro / Workspace ONE)

Used for macOS / Windows devices managed by Jamf or Workspace ONE.

Key differences:

  • Okta generates the dynamic secret, not the MDM.

  • The device management system pushes the SCEP profile but does NOT generate the secret.

Everything else (certificate request & issuance) works similarly.

⭐ 5. Steps to Configure Management Attestation (Okta + MEM Example)

Step 1 — Create Azure AD App Registration

Enables secure API communication between MEM and Okta.

Step 2 — Configure Management Attestation in Okta

  • Set up Okta as the CA

  • Generate the SCEP URL

Step 3 — Download X.509 Certificate

Used by MEM to trust Okta as the CA.

Step 4 — Create Trusted Certificate Profile in MEM

MEM must trust certificates issued by Okta.

Step 5 — Create SCEP Profile in MEM

Includes:

  • SCEP URL

  • Challenge type (delegated dynamic challenge)

MEM pushes this to desktops.

Step 6 — Verify on Windows or macOS

  • Enroll device in FastPass

  • Confirm certificate exists and is valid

⭐ 6. Using Certificates in Authentication Policies

Once certificate issuance is complete:

  • Okta Verify will present the certificate to Okta during authentication

  • Okta uses the cert to validate:

    • “Is this device managed?”

    • “Is the certificate valid, trusted, non-expired?”

You can then enforce:

  • Managed device required

  • Step-up MFA if unmanaged

  • Block unmanaged devices from sensitive apps