
ÉricF.83978 (Customer) asked a question.
We would like to send device compliance change CAEP events from our MDM to Okta, and we are wondering how Okta can associate the event with a given device. For each event included in a SET, there is a subject.device attribute. We can use the iss_sub format for this, but would Okta expect the device serial number as "sub" ?

Hello @ÉricF.83978 (Customer)
Thank you for posting on our Community page!
Please see our documentation on this matter below:
https://help.okta.com/oie/en-us/content/topics/itp/configure-shared-signal-provider.htm
https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SSFSecurityEventToken/
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
I had read those pages, and this is why I asked the question. The example is incomplete on the SSF SET page (empty device subject). I cannot find any information about the device identifier expected by Okta (serial number ?)
Some updates. I have managed to send a session revoked event and link it to a user, but the device target it contains doesn't show up. I have tried the device UDID, the device Serial Number.
The examples at https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SSFSecurityEventToken/ have been updated and now contains {"format": "opaque", "id": "device-identifier-001"} but when I post something like this, I get a 400 error saying that "sub" is a required attribute.