The end user did not log in with Fastpass after renewing the certificate.

Have the end user authenticate using Fastpass on the affected device.

For more information, see: FastPass Login is Required for Device to Show as Managed.

The end user's client certificate has expired, was revoked, or is no longer valid.

Remove the existing client certificate and issue a new one.

For more information, see: Client certificates.

The end user has registered two devices with the exact same certificate in the same Okta organization. Certificates require a unique identifier per device within the same organization, as the certificate ID is bound to the device within the Universal Directory; this prevents users from reusing a given certificate on another device.

Remove the client certificate from one of the affected devices and issue a new one.

For more information, see: Client certificates.

Clock drift/time skew has caused the machine's time to fall out of sync with Okta's servers.

Ensure that the user's machine is synced to the correct Network Time Protocol (NTP) server, and that the device is set to automatically set the date and time.

For more information, see: Okta Verify Logs Showing the Error "Authorization Error: ID Token expired".

When using Bring Your Own Certificate Authority (BYOCA), the certificate chain may become invalid, be revoked, or expire.

Upload a new certificate chain in the Admin Dashboard.

For detailed instructions, see: Use your own certificate authority for managed devices

The device's activation status has changed:

• An administrator deactivates or deletes a user's device, and the end user does not re-register the device.
• An administrator changes the device status to Suspended or Deactivated in the Okta Admin Console by navigating to Directory > Devices.

Correct the device's activation status:

• If the device has been deactivated and subsequently deleted, the user can correct the management status by authenticating with Okta Verify on the device, using the managementHint or a client certificate.
• If the device has been deactivated or suspended but not deleted, the user cannot re-register it; it must be reactivated or fully deleted by an administrator.

For more information, see: Okta Verify Invalidated Device or Illegal Device Errors.

The authentication policy rules are misconfigured.

The Application Sign-On Policy (ASOP) requires additional configuration to effectively leverage a device's management status. 

A comprehensive guide to the necessary configurations may be found here: How to Configure Authentication Policies for Device Management.

The user has not authenticated at least once with Okta Verify Push or Fastpass. 

For BYOCA configurations, the Certificate Revocation List (CRL) cannot be reached.

If the client certificate cannot be identified as active in the CRL during the management attestation evaluation, Okta marks the device as not managed. The CRL must be publicly accessible.

For more information, see: How does the CA affect client certificate binding?.

After being issued a client certificate, the user does not complete a Fastpass authentication within 90 days.

When using Okta as a Certificate Authority (CA), Okta revokes the client certificate on the 91st day after issuance if the user fails to complete a successful Okta FastPass flow.

For more information, see: Okta CA Client Certificate is Revoked after 90 Day of Issuance.

The Okta Verify application fails to run in the background on Android.

Okta Verify must maintain a persistent local web server. This requires additional configuration for Android.

For more information, see:

• Okta Verify authentication issues when users sign in from WebView
• Okta Verify on Android Devices Error "You do not have permission to perform the requested action"

The Client Secret Keys for the Dynamic Simple Certificate Enrollment Protocol (SCEP) URL have expired.

Client certificates cannot be issued if the Client Secret Keys have expired.

For more information, see: Okta System Logs Showing the Error "FAILURE: Error while issuing a ClientCertificate via delegated SCEP".

When using BYOCA, the end user's client certificate fails to match the private key on Windows devices. Okta Verify logs show the error: "Failed to acquire private key for certificate [Thumbprint Value]: Error: 0x80090016"

An administrator deletes a managed device from the user profile in Okta, which invalidates the device management certificate.

A new certificate must be issued to the device before it can be recognized as Managed again. 

For more information, see: How to Make a Device Managed Again.