A common misconception is that a certificate assigned to a specific user only functions on a single device. When Intune deploys a certificate, Okta applies the certificate to the device rather than the user. This clarifies how Okta handles device trust and management attestation with delegated Simple Certificate Enrollment Protocol (SCEP) certificates.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Mobile Device Management (MDM)
• Microsoft Intune
• Simple Certificate Enrollment Protocol (SCEP) Certificate

How does Okta handle management attestation with delegated SCEP certificates?

The following details explain how Okta processes delegated SCEP certificates for device trust.

• The certificate applies to the device, not the user. The device status changes to Managed for other users accessing the same machine under the same machine user profile when they sign in to Okta.
• Importing a public key certificate from one device to another does not affect the management attestation.
• Okta requires the private key to create the management attestation.
• Okta manages the device based on the initially deployed certificate.

NOTE: Okta binds the deviceId and the client certificate during the first authentication. Subsequently, if a different device uses the client certificate for a management attestation, the management attestation fails.

Related References

• Management attestation FAQ
• Configure Okta as a CA with delegated SCEP challenge for Windows using MEM (formerly Intune)
• Configure Management Attestation for Desktop Devices with MEM (formerly Intune)