Verify device compliance before MFA and SSO with Okta for MSPs

Okta evaluates device posture in real time and enforces access accordingly. Typical controls include:

• Minimum OS versions (Windows build, macOS release, iOS/Android version)
• Patch/update recency within a defined time window
• Disk encryption and screen lock enabled
• Management state
• Other posture signals

You attach Okta device assurance policies to authentication policy rules, so you can configure the right baseline for each app or group. It’s useful to have this flexibility, since you’ll often have clients where device assurance is really only warranted for a subset of sensitive apps and highly privileged users.
Use device assurance policies on their own, or layer device assurance with device trust as part of your broader Zero Trust strategy.

ZeroTek makes Okta’s enterprise-grade identity and access management (IAM) technology ideal for MSPs—and their SMB clients.

• Built for how you operate. Get multi-tenant control of all your client Okta orgs, MSP-ready role-based access control (RBAC), and strong standardized baselines you can clone across clients.
• Faster time to value. Spin up Okta orgs in seconds, set up field-tested Okta configurations in minutes, and roll out changes safely in phases.
• Flexible licensing. Usage-based billing maps cleanly to your managed services pricing for your SMB clients and makes it easy to scale.

Device assurance policies are platform specific. Conditions you set for Windows devices won’t apply to macOS; you’ll use different policies for different platforms. Define posture baselines per platform—Android, ChromeOS, iOS, macOS, and Windows—so Okta device assurance can verify device compliance accurately at sign-in.

Target and test first. Even with ZeroTek’s proven guidance, start with a pilot group and a single app. Attach your device assurance policy or policies to the relevant authentication policy rule, then monitor authentications and remediation prompts. Validate that everything is working as expected before expanding coverage.

• Deploy Okta FastPass (if it isn’t already). Okta device assurance requires Okta FastPass is in place first. (But with or without device assurance, ZeroTek recommends deploying FastPass anyway—because there’s no better way to deliver a low-friction, high-security, passwordless experience for your clients.)
• Create your device assurance policies and define compliance standards for each target group or app.
• Attach device assurance to an Okta authentication policy rule. As suggested above, test device assurance in a targeted way first.
• Expand across groups, apps, and clients as required.
• Optionally add device trust for managed-only device access for the most sensitive applications.

• Measurable risk reduction without agents or custom scripts.
• Lower support friction. Compliant users sail through with FastPass; non-compliant devices see remediation prompts.
• Clear market differentiation. Offer tiered packages—device assurance, device trust, or both—to match each client’s risk profile, compliance needs, and budget, with a straightforward upsell path as requirements mature.