Hello,

We are using Okta as IDP and to provision users to M365 and are in the process of enrolling devices as Hybrid Entra Join, Devices are being enrolled and registered properly but seems AzureADPRT is not retrieved always and this way the devices are not able to use features such as Windows Hello for Business.

Devices are synced to M365 but not through AD connect, Instead using Okta provisioning and no UPN matching between M365 and AD, i.e. user domain in AD is contoso.com and in M365 is Fabrikam.com.

My question is what settings need to be modified on Okta to retrieve this token for logged in local AD users, Any mappings or sign on policies that need to be in place so that AzureADPRT is granted, etc....?