Device registration

Device registration binds a device to the Okta Verify app instance on the device. Each registered device is a unique object in the Okta Universal Directory and is listed on the Devices page in the Admin Console.

Device registration happens when users set up an account in Okta Verify or when the device is in Sensor Mode. You can't add devices from the Admin Console.

Registration flow

  1. Users create an account in Okta Verify, or an admin enrolls the device in Device Posture Sensor Mode.
  2. A unique key is created and stored on the device. The key is stored in a hardware-backed keystore (for example, the Trusted Platform Module, or Secure Enclave) or a software-backed keystore.
  3. Okta creates a device record in the Universal Directory. The device is now bound to the Okta Verify app instance. To see the device record in the Admin Console, go to Directory > Devices.

Registered device verification

When users access an Okta-protected app from the device, Okta probes the device for the following attributes:

  • Okta Verify is installed on the device.
  • The device is registered. This means an Okta Verify account exists or the device is in Sensor Mode.
  • The device is managed. This means the device is managed by a device management solution and configured for device management in Security > Device Integrations.
  • Secure hardware is present (TPM, Secure Enclave).
  • Proof of possession key is hardware-protected.

If the probe is successful, the user.authentication.auth_via_mfa is logged in the System Log and the end user is able to proceed with their task. Otherwise, they're unable to proceed.