Okta Org2Org Device Claim Feature Fails Due To Granular Device Assurance Rules

Okta denies user sign-on to a target organization when an administrator enables the Okta Org2Org device claim feature in a source organization. This authentication failure occurs because the target organization uses granular device assurance rules, which the device claims sharing feature does not support. Implement granular assurance in the source organization and remove it from the target organization policy to resolve the authentication failures. During inspection, Okta appears to pass the device status correctly, but the target organization policy still rejects the authentication attempt because it cannot satisfy the device-status requirement.

• Okta Identity Engine (OIE)
• Org2Org
• Device Assurance
• Device Claims Sharing
• Authentication Policies

The Authentication Sign-On Policy (ASOP) in the target organization contains granular device assurance rules, such as specific operating system (OS) versions, disk encryption state, and Endpoint Detection and Response (EDR) scores. The device claims sharing feature only supports broad device assurance, such as Registered or Managed, and does not pass granular device claims.

How are granular device assurance rules configured for Okta Org2Org?

Implement the granular assurance in the source organization, remove the granular rules from the target organization policy, and enable device claim sharing by following these steps.

1. Open the source organization and configure the granular device assurance rules within the authentication policies.
2. Open the target organization and remove the granular device assurance rules from the Authentication Sign-On Policy (ASOP).
3. Configure the target organization policy to require only broad device assurance, such as Registered or Managed.
4. Enable the device claim sharing feature to allow the source organization to pass the broad device status to the target organization.