This article reviews how to configure Authentication Policies for Okta Device Management in the Okta Identity Engine (OIE).

• Okta Identity Engine (OIE)
• Okta Verify - FastPass
• Device Management
• Authentication Policies

Authentication Policies must be specifically configured to enable device management checks. 

1. In the Admin Console, navigate to Security > Authentication Policies.

2. Select the authentication policy that should be added to a rule.

3. In the Authentication Policy, click Add Rule.

4. Type a Rule name to describe the rule.
5. Configure the appropriate IF conditions to specify when the rule is applied.
   • Rules should target user groups that are being enabled for FastPass Device Management.
6. Look for AND Device state is and change the condition from Any to Registered. Once the Device State is set to Registered, another option will appear immediately below the Device state for: AND Device management is; to enable Device Management checks on the policy, set this option to Managed.

7. Configure the appropriate THEN conditions to specify how authentication is enforced.
8. Configure the re-authentication frequency if needed.
9. Click Save.

To make sure that Device Management is enforced, either:

• Create another rule targeting the same user groups configured in the rule above (Configured in the IF Conditions), which is configured to deny the login.

• Modify the Catch All Rule to deny login.

NOTE:

• When device management is enforced, the device context is required to determine its status (the device can only be "registered" or "registered and managed").
• To determine the device status, users will be prompted to set up Okta Verify FastPass on the device from which they access the restricted resources.

Related References

• Authentication Policies
• Add an authentication policy rule for desktop 
• Configure management attestation for desktop devices
• Troubleshooting Management Attestation For Desktop Devices (OIE)