Configure Okta Device Trust with Hexnode UEM

Step 1: Integrate Okta with the Hexnode UEM portal

To begin, integrate your Okta account with the Hexnode UEM portal. For detailed steps, refer Okta Integration Guide.

After successfully integrating, you can choose to click Next within the same window to configure Okta Device Trust (optional).

Alternatively, you can skip this step and move on to Step 2, where Okta Device Trust can be configured separately using its own integration tile.

Step 2: Set up Okta Device Trust in the Hexnode UEM portal

Once Okta is integrated, you can set up Okta Device Trust from within the Hexnode portal:

1. Log in to your Hexnode UEM portal.
2. Navigate to Admin > Integrations.
3. Click on the Okta Device Trust tile.
4. A prompt will ask for your organization’s Okta domain credentials.
5. Choose the configured Okta domain from the dropdown menu and click Proceed. If no Okta domain has been set up yet, you can create a new integration by selecting Add new domain and following the steps outlined in the previous section.
6. Click Next.



Next, you’ll need to create the API Service Integration credentials for Okta Device Trust:

Generate API service integration credentials in Okta admin console

1. Log in to your Okta admin console.
2. Navigate to Applications > API Service Integrations.
3. Click Add Integration.
4. Select Hexnode Device Trust from the options and click Next.
5. Click Install & Authorize in the following window.
6. A pop-up will display the Client Secret for your Hexnode Device Trust integration. Copy this secret (it appears only once) and keep it secure.
7. Click Done.

You’ll be redirected to the Hexnode Device Trust integration page in the Okta admin console, where you can view the integration details such as the Okta domain and Client ID.

Return to the Hexnode UEM portal, enter the Client ID and Client Secret into their respective fields on the API Service Integration Credentials page, and then click Next to proceed.



After entering the API service integration credentials, you’ll be directed to the Configure Management Attestation page. This is where you configure the device platform(s) – iOS, Android, macOS, or Windows – on which you intend to deploy the Okta Verify app.



Configuring device platforms in Okta

Before configuring device platforms in Hexnode UEM, you must first set them up in the Okta admin console and generate the necessary credentials for use in Hexnode. Follow the steps below to complete the setup.

1. Log in to your Okta admin console.
2. Go to Security > Device Integrations > Add platform.

   For Android devices:

   1. Enter the device management provider’s name (Hexnode UEM) and the enrollment link (e.g., https://yourportalname.hexnodemdm.com/enroll).
   2. Copy the Secret Key and store it securely for later use in the Hexnode UEM portal.
   3. Click Save.

   For iOS devices:

   1. Enter the device management provider’s name (Hexnode UEM) and the enrollment link (e.g., https://yourportalname.hexnodemdm.com/enroll).
   2. Copy the Secret Key and store it securely for later use in the Hexnode UEM portal.
   3. Click Save.

   For macOS devices:

   1. Select the certificate authority, choose the SCEP URL challenge type, and click Generate to create the SCEP URL.
   2. Copy the generated SCEP URL and Secret Key for later use in the Hexnode UEM portal.
   3. Click Save.

   For Windows devices:

   1. Select the certificate authority, choose the SCEP URL challenge type, and click Generate to create the SCEP URL.
   2. Copy the generated SCEP URL and Secret Key for later use in the Hexnode UEM portal.
   3. Click Save.

   You must also generate and download a CA certificate to configure Windows as a platform in the Hexnode UEM console.

   1. In the Okta admin console, go to Security > Device Integrations.
   2. Select the Certificate authority tab.
   3. Locate the Okta CA Certificate Authority and click the Download x509 certificate icon under the Actions column.

Configuring device platforms in Hexnode

Back in the Hexnode UEM portal, on the Configure Management Attestation page:

1. Enable the required platform(s) and enter the necessary details such as Secret Key, SCEP URL, CA Certificate, and Subject.

   

   Note:

   
   In the Hexnode portal, you’ll be asked to enter a Subject while configuring Okta Device Trust. This is critical for enabling Okta Device Trust, as Okta relies on this value to validate that the certificate comes from a trusted source.

   For e.g., CN=$COMPUTERNAME managementAttestation $UDID
   Here,

   • CN: Stands for Common Name, a standard part of any certificate.
   • $COMPUTERNAME: A placeholder that will automatically be replaced with the actual name of the device.
   • managementAttestation: A fixed keyword that signals this certificate is meant for Okta Device Trust.
   • $UDID: A placeholder that will be replaced with the device’s unique ID.

2. After configuring the platforms, click Next.
7. Select the user/device groups for Okta Device Trust deployment.

   

   How to assign users and devices?

   During Okta Device Trust setup in Hexnode UEM, admins must define which users, and which devices fall under device trust enforcement. This happens in two ways:

   • User group assignment: These are Okta user groups imported into Hexnode through the Okta integration. During Okta Device Trust setup, the admin selects one or more of these groups to be included in Device Trust enforcement. Only devices owned by users in the selected groups are considered for Okta Device Trust enforcement.
   • Device group assignment: These are groups of enrolled devices created in the Hexnode console. During Okta Device Trust setup, the admin selects one or more of these device groups. Hexnode verifies whether each device belongs to a user in the Okta domain configured for Okta Device Trust integration in the Hexnode UEM portal and considers only those devices for Okta Device Trust enforcement.

     For example, if a device group has 6 devices and 4 are linked to users from the Okta domain configured for Okta Device Trust integration in the Hexnode UEM portal, only those 4 devices will be included in device trust enforcement.

   Disclaimer:

   
   The user group selected for Okta Device Trust deployment must not include the admin account used to create authentication policies in the Okta admin console. If the admin account is included, the applied authentication policy will affect it as well, potentially leading to the admin account being locked out.

   Once you’ve selected the endpoints, the next window will prompt you to install Okta Verify and complete the integration. For macOS and Windows devices, this window will present different installation methods tailored to each operating system.

   

   Installation methods for Okta Verify app on macOS devices

   Choose from the following two options to install the Okta Verify app on macOS devices.

   1. App purchased via ABM/ASM (Recommended).

      

      1. Login to your Apple Business/School Manager account.
      2. Navigate to the Apps and Books section.
      3. Search for the Okta Verify app and select it.
      4. In the window that appears, under Assign to, choose the server token where the app license should be assigned.
      5. Enter the required quantity of app licenses.
      6. Click Get to assign the app to the selected server token.

      The Okta Verify app will now be assigned to the specified server token. This token must be used when adding your VPP account to the Hexnode UEM portal. For detailed instructions on how to add a VPP account to your Hexnode UEM portal, refer the documentation.

   2. PKG file downloaded from Okta.

   Installation methods for Okta Verify app on Windows devices

   Choose from the following two options to install the Okta Verify app on Windows devices.

   1. Upload file: Upload the EXE file downloaded from Okta.
      
      1. In your Okta admin console, go to Settings > Downloads.
      2. Under End User Apps > Okta Verify for Windows (.exe), choose either Download General Availability or Download Early Access.
      3. Upload the downloaded EXE file to the Hexnode UEM console during the Set up Okta Device Trust in the Hexnode UEM portal step to proceed with the installation of Okta Verify.
      4. Configure the basic app details such as App Name, Category, and Description.
      5. Define the success criteria and uninstallation parameters.

         

   2. Select from existing exe apps:
      1. Choose the pre-uploaded Okta Verify EXE file from your Hexnode UEM app inventory.
      2. Hexnode will automatically populate the app details, success criteria, and uninstall settings that were defined in the EXE app.
8. Once you’ve configured the Okta Verify app installation methods, click Install Okta Verify to complete the Okta Device Trust integration.

Step 3: Create authentication policies in Okta admin console

To define access control rules for your organization’s resources, you’ll need to set up authentication policies in the Okta admin console. Here’s how:

1. Log in to Okta admin console.
2. Go to Security > Authentication Policies > Add a policy.
3. Enter a name and description for the policy, then click Save.
4. Add the necessary rules and assign apps based on your organization’s access requirements. For detailed guidance, refer the Authentication policies document.