Configure Management Attestation for Mobile Devices

✅ OCA Study Notes — Configure Management Attestation for Mobile Devices

Management Attestation for mobile devices allows Okta to verify whether Android and iOS devices are managed by an MDM/EMM before granting access to sensitive applications.

This is part of Okta’s Zero Trust model:

Never trust the device until it proves it is managed and compliant.

⭐ 1. Why Mobile Device Management Attestation Matters

When an authentication policy requires “device must be managed”, Okta must confirm:

  • The device is enrolled in your MDM

  • The user is using Okta Verify / FastPass

  • The device presents a valid management hint (secret)

This enables app access only from secure, compliant mobile devices.

⭐ 2. How Okta Confirms Device is Managed

Unlike desktops (which use a client certificate), mobile devices use a Management Hint.

The Management Hint

  • A secret code generated in the Okta Admin Console

  • Distributed to all MDM-enrolled mobile devices

  • Sent back to Okta automatically during FastPass authentication

  • If the hint matches → device is verified as managed

⭐ 3. Authentication Flow for Managed Mobile Devices

1. User opens an app → triggers Okta FastPass

FastPass begins evaluating:

  • User identity

  • Device trust posture

2. Device sends the Management Hint

The MDM-delivered secret is included in the authentication request.

3. Okta checks:

  • Is the Management Hint present?

  • Does it match the one generated in Okta?

  • Is Okta Verify enrolled on the device?

4. Policy Decision

If device meets policy criteria:

  • Access granted

  • FastPass provides seamless sign-in (passwordless)

If device does not meet criteria:

  • Stronger MFA required

  • Or access denied

⭐ 4. Setup: Configure Management Attestation for Mobile Devices

Step 1 — Generate the Management Hint in Okta

Navigate to:

Security → Device Integrations

Choose platform:

  • Android

  • iOS

Then:

  • Generate a unique secret key

  • This is the Management Hint

  • Okta will expect devices to present this secret

Step 2 — Integrate Okta with Your MDM

Your MDM must:

  • Support Managed App Configuration

  • Support silent/automatic installation of Okta Verify on enrolled devices

Configure MDM with:

  • Managed app configuration for Okta Verify

  • Key-value pair:

    • Key = management hint identifier

    • Value = secret key you generated in Okta

When the MDM pushes this config:

  • Each enrolled device stores the secret

  • Okta Verify includes the hint in authentication requests

⭐ 5. Summary of Key Concepts

What proves a mobile device is managed?

The Management Hint (secret key).

Who delivers the secret to devices?

The MDM via managed app configuration.

When is the hint used?

During FastPass authentication.

Why is this important?

To restrict access to sensitive apps to only properly managed, compliant mobile devices.