Every registered device in the Okta Identity Engine (OIE) is a unique object within the Okta Universal Directory. This provides visibility into the devices that access Okta and enables decision-making about user access.
- Devices and Mobile Apps
- Okta Identity Engine (OIE)
- Device Trust 2.0 / Device Integrations
View the details for any enrolled device. There are two ways to find the devices in the Okta Admin Console:
- Go to Directory > Devices, and then click a device name.
- Alternatively, go to Directory > People, select a user's name, click Devices, and then click a device name.
Some device details are platform-specific. For most devices, the following information can be viewed:
To identify the device.id that accessed Okta:
- Refer to the device ID in the syslog to view the device information.
- Query the system log where
eventType eq "user.authentication.verify" and actor.id eq "<userId>". - Expand the event information to see the
device.idand copy it. - Use the copied
device.idto replace the <deviceid> in the org URL:<subdomain>oktapreview.com/admin/devices-inventory#<deviceid><subdomain>okta.com/admin/devices-inventory#<deviceid>
Here is an example:
NOTE: The device ID is not included in the system log CSV export.
Device users
A user profile represents an identity that uses an enrolled device to sign in to the org. A user can have more than one profile on a device. For example, a single user can have a business profile to access restricted company apps and a personal profile to access personal files. A single device can also have more than one user who signs in on it. The device details page displays a maximum of 20 users associated with the device, even though more than 20 may be assigned to it.
| Details by device user | Description | Example |
|---|---|---|
| User | A user's name and email address. | Test User T.user@example.com |
| Enrollment date |
The date when the device was enrolled in Okta Verify. | |
| Management status |
Managed:
Not managed:
| |
| Lock screen | Indicates whether the screen lock is Disabled, Password, or Password with Windows Hello. |
Device security signals
| Device security signal | Description | Example |
|---|---|---|
| OS version | The OS version installed on the device. | 13.5.1 |
| Disk encryption |
Indicates whether the device is encrypted. | Fully encrypted |
| Secure Enclave |
Indicates whether the iOS and macOS device supports Secure Enclave. | Supported |
| Jailbreak |
Indicates whether the iOS device is jailbroken. | Not jailbroken |
| Hardware Keystore |
Indicates whether the Android device supports a hardware keystore. | Supported |
| Rooting |
Indicates whether the Android device is rooted. | Not rooted |
| Trusted Platform Module | Indicates whether the Windows Trusted Platform Module is in use. | Not in use |
Device identifier
| Device identifier | Description | Example |
|---|---|---|
| Display Name | The display name of the device. | Maya's iPhone |
| Platform | The operating system of the device. | iOS device |
| Manufacturer | The vendor that created the physical device. | APPLE |
| Model | The device type or design. | iPhone |
| OS Version | The device's operating system software version. | Version 11.4 (Build 20F71) |
| IMEI | International Mobile Equipment Identity (IMEI) is a unique number used to identify a mobile device on a Global System for Mobile Communications (GSM) network. Okta Verify does not collect this information, but other custom applications may. | |
| MEID | The Mobile Equipment Identifier (MEID) is a unique number used to identify a mobile device on a network that uses Code-Division Multiple Access (CDMA) protocols for second- and third-generation wireless communication.
Okta Verify does not collect this information, but a custom application can. | |
| UDID | The unique device ID (UDID). The UDID is a unique identifier for Apple devices running iOS, macOS, tvOS, or watchOS. | ********-****-****-****-************ |
| Security identifier | The security identifier (SID). The SID is a unique number of a user, user group, or other security principal. | X-1-00000000000000-0 |
| Dedicated hardware | Indicates if dedicated hardware exists for a Trusted Platform Module (TPM).
The unique identifier (hash) is not shown for devices with a Trusted Platform Module (TPM). Instead, the placeholder Present - No hash available appears. |
