diff --git a/en/oie/Content/Search.htm b/en/oie/Content/Search.htm index 423dfac33bc..0ace37238d9 100644 --- a/en/oie/Content/Search.htm +++ b/en/oie/Content/Search.htm @@ -16,6 +16,8 @@ + + @@ -75,6 +77,26 @@ })(window,document,'script','dataLayer','GTM-KXMLV58'); /* ]]> */ +
@@ -323,8 +345,6 @@

Your search for returned - + +
@@ -337,8 +359,6 @@

See also

- + +
@@ -397,8 +419,6 @@

Configure Active Directory import and account se

- + +
@@ -330,7 +352,7 @@

Configure Risk
  • Enter a Rule Name.

  • -
  • Indicate your conditions.
    • IF User’s user type is: Specify a user type, or leave the default Any user type. Click Go to User Types to see your org’s User Types page.

    • AND User’s group membership includes: Specify at least one user group, or leave the default Any user group. Click Go to Groups to see your org’s Groups page.

    • AND User’s IP is: Specify an IP Zone, or leave the default Any IP. Click Go to Network Zones to see your org’s Network Zones page.

    • AND Risk is: Select a risk level of Low, Medium, or High to change the level of risk that is needed to match the rule. The risk level Any is selected by default.
    • AND The following custom expression is true: Enter the expression language to define security signals. See Behavior
  • +
  • Indicate your conditions.
    • IF User’s user type is: Specify a user type, or leave the default Any user type. Click Go to User Types to see your org’s User Types page.

    • AND User’s group membership includes: Specify at least one user group, or leave the default Any user group. Click Go to Groups to see your org’s Groups page.

    • AND User’s IP is: Specify an IP Zone, or leave the default Any IP. Click Go to Network Zones to see your org’s Network Zones page.

    • AND Risk is: Select a risk level of Low, Medium, or High to change the level of risk that is needed to match the rule. The risk level Any is selected by default.
    • AND The following custom expression is true: Enter the expression language to define security signals. See Behavior.
  • In the THEN Access is condition, select an action.

      @@ -428,8 +450,6 @@

      Configure Risk

  • - + +
    @@ -388,8 +410,6 @@

    Related topics

    - + +
    @@ -351,8 +373,6 @@

    Related Topic

    - + +
    @@ -424,8 +446,6 @@

    Related topics

    - + +
    @@ -385,8 +407,6 @@

    Related topics

    - + +
    @@ -381,8 +403,6 @@

    Security Behavior Detection configuration

    - + +
    @@ -341,8 +363,6 @@

    Next Step

    - + +
    @@ -341,8 +363,6 @@

    Next Step

    - + +
    @@ -352,8 +374,6 @@

    Next Step

    - + +
    @@ -369,8 +391,6 @@

    Related topics

    - + +
    @@ -332,8 +354,6 @@

    Start this task

    - + +
    @@ -334,8 +356,6 @@

    Start this task

    - + +
    @@ -402,8 +424,6 @@

    Related topics

    - + +
    @@ -341,8 +363,6 @@

    Next Step

    - + +
    @@ -504,8 +526,6 @@

    Related topics

    - + +
    @@ -459,8 +481,6 @@

    Related topics

    - + +
    @@ -341,8 +363,6 @@

    Related topics

    - + +
    @@ -391,8 +413,6 @@

    Related topics

    - + +
    @@ -353,8 +375,6 @@

    Related topics

    - + +
    @@ -357,8 +379,6 @@

    Related topics

    - + +
    @@ -363,8 +385,6 @@

    Related topics

    - + +
    @@ -335,8 +357,6 @@

    Related topic

    - + +
    @@ -348,8 +370,6 @@

    Related topics

    - + +
    @@ -348,8 +370,6 @@

    Related topics

    - + +
    @@ -342,8 +364,6 @@

    Define IP Types for a - + +
    @@ -376,8 +398,6 @@

    Related topics

    - + +
    @@ -340,8 +362,6 @@

    Delete a

    - + +
    @@ -342,8 +364,6 @@

    Related topics

    - + +
    @@ -356,8 +378,6 @@

    Related topics

    - + +
    @@ -340,8 +362,6 @@

    Related topic

    - + +
    @@ -368,8 +390,6 @@

    Related topics

    - + +
    @@ -370,8 +392,6 @@

    Topics

    - + +
    @@ -356,8 +378,6 @@

    Topics

    - + +
    @@ -382,8 +404,6 @@

    Related topics

    - + +
    @@ -342,8 +364,6 @@

    Configure Okta ThreatInsight system log events

    - + +
    @@ -346,8 +368,6 @@

    Before you begin

    - + +
    @@ -340,8 +362,6 @@

    Before you begin

    - + +
    @@ -332,8 +354,6 @@

    HealthInsight Reporting on Okta ThreatInsight

    - + +
    @@ -339,8 +361,6 @@

    Topics

    - + +
    @@ -340,8 +362,6 @@

    Okta Admin Console

    - + +
    @@ -349,8 +371,6 @@

    Topics

    - + +
    @@ -349,8 +371,6 @@

    Related topics

    - + +
    @@ -475,8 +497,6 @@

    Authenticator overview

    - + +
    @@ -357,8 +379,6 @@

    Related topics

    - + +
    @@ -360,8 +382,6 @@

    Related topics

    - + +
    @@ -338,8 +360,6 @@

    Related topics

    - + +
    @@ -382,8 +404,6 @@

    Related topics

    - + +
    @@ -415,8 +437,6 @@

    Related topics

    - + +
    @@ -363,8 +385,6 @@

    Next step

    - + +
    @@ -363,8 +385,6 @@

    Next step

    - + +
    @@ -361,8 +383,6 @@

    Related topic

    - + +
    @@ -399,8 +421,6 @@

    Related topic

    - + +
    @@ -414,8 +436,6 @@

    Next step

    - + +
    @@ -347,8 +369,6 @@

    Topics

    - + +
    @@ -342,8 +364,6 @@

    Next step

    - + +
    @@ -339,8 +361,6 @@

    Topics

    - + +
    @@ -535,8 +557,6 @@

    Related topics

    - + +
    @@ -270,15 +292,21 @@
    -

    Administer devices

    -

    You can administer the registered devices in your org through the Devices page.

    -

    Topics

    +

    Configure a Certificate Authority

    +

    When evaluating an app sign-on policy that requires devices to be managed, Okta determines the management status of your targeted Windows devices by verifying whether a client certificate is installed on the device. Okta attests certificate installation by creating a digital signature with the certificate and validating it on the server. Configuring a Certificate Authority (CA) allows you to issue client certificates to devices to support this operation.

    +

    Configure Okta as a CA

    +

    Using Okta's default CA saves time, streamlines the issuance of certificates and allows you to avoid the complexity and expense of deploying and maintaining your own PKI infrastructure.

    +

    To configure Okta as a CA, you will create a SCEP profile in your MDM and generate a SCEP URL in Okta.

    +

    Provide your own CA

    +

    To provide your own CA, your environment requires a PKI infrastructure that is integrated with your MDM solution to distribute Okta-provided client certificates to targeted devices. See Provide your own Certificate Authority for Device Trust on Identity engine.

    Top
    @@ -332,8 +360,6 @@

    Topics

    - + +
    @@ -291,8 +313,7 @@

    How device registration works

    Related topics

    @@ -349,8 +370,6 @@

    Related topics

    - + +
    @@ -270,7 +292,7 @@
    -

    Devices in Identity engine

    +

    Device administration

    Okta Devices is a Platform Service of the Okta Identity Cloud that embeds Okta on every device to give organizations:

    @@ -341,8 +363,6 @@

    Topics

    - + +
    @@ -563,8 +585,6 @@

    Related topics

    - + +
    @@ -346,8 +368,6 @@

    Topics

    - + +
    @@ -344,8 +366,6 @@

    Related topics

    - + +
    @@ -375,8 +397,6 @@

    Operating system

    - + +
    @@ -363,8 +385,6 @@

    Related topics

    - + +
    @@ -338,8 +360,6 @@

    Where can I learn more about - + +
    @@ -332,8 +354,6 @@

    Topics

    - + +
    @@ -468,8 +490,6 @@

    Windows Security Center value definitions

    - + +
    @@ -438,8 +460,6 @@

    Related topics

    - + +
    @@ -339,8 +361,6 @@

    Related topics

    - + +
    @@ -275,7 +297,6 @@

    Integrate

    You can integrate Okta Verify with your organization’s Endpoint Detection and Response (EDR) solution. When users try to access a protected resource, Okta Verify probes their device for context and trust signals and uses these to inform the access decision. EDR integration extends device posture evaluation by enabling Okta Verify to capture signals collected by your EDR client running on the same device. All signals are then sent to the Okta server and evaluated against the app sign-on policies that you have configured in the Okta Admin Console. Okta currently supports integrations with CrowdStrike and Microsoft Windows Security Center. Support for more EDR vendors is planned for the future.

    -

    See Event Types

    Topics

    - + +
    @@ -336,8 +358,6 @@

    Limitation

    - + +
    @@ -420,8 +442,6 @@

    Next step

    - + +
    @@ -938,8 +960,6 @@

    Related topics

    - + +
    @@ -276,7 +298,10 @@

    Manage device lifecycle

    -

    With the exception of Created, you can change the following device lifecycle states:

    +
    +
    +
    +

    You can change the following device lifecycle states:

    @@ -498,8 +523,6 @@

    Related topics

    - + +
    @@ -391,8 +413,6 @@

    Related topic

    - + +
    @@ -358,8 +380,6 @@

    Related topic

    - + +
    @@ -275,7 +297,7 @@

    Configure Okta as a Certificate Authority for Windows using Intune

     

    Note -

    To configure a static SCEP challenge type for Windows using Workspace ONE, see. Configure Okta as a Certificate Authority for Windows using Workspace ONE

    +

    To configure a static SCEP challenge type for Windows using Workspace ONE, see Configure Okta as a Certificate Authority for Windows using Workspace ONE

     

    Before you begin

    @@ -439,8 +461,6 @@

    Next step

    - + +
    @@ -381,8 +403,6 @@

    Next step

    - + - - - - - +
    @@ -202,18 +223,18 @@
    - - - - - - - - - - - - - - - - - - -
    OptionWhat it does
    Any client -

    Default option. Applies the rule irrespective of the user's client.

    -

    This option does not support multifactor authentication. Only single-factor password-based authentication will be used to authenticate users. -

    -
    One of the following clients -

    Applies the rule to specific clients. See the table below for options.

    -
    -

    Client options

    - - - - - - - - - - - - - - - - - - - - - - - -
    OptionWhat it does
    Web browserApplies the rule to web browsers such as Chrome, Safari, or Internet Explorer.
    Modern Authentication -

    Applies the rule to thick client applications configured to leverage Modern Authentication. This includes Office 2013 and 2016 clients with required patches or configuration updates, as detailed in this Microsoft Support documentation: Updated Office 365 modern authentication.

    -

    Modern Authentication is a configurable setting on an Office 365 tenant for Exchange Online. See Microsoft documentation: Enable or disable modern authentication in Exchange Online and Office 365: Enable Modern Authentication.

    -
    Exchange ActiveSync/ Legacy Authentication -

    Applies the rule to native mail clients on iOS or Android devices, as well as older desktop clients on macOS and MS Windows that do not support Modern Authentication.

    -

    Exchange ActiveSync or Legacy Auth client do not support multifactor authentication. Only single-factor password-based authentication will be used to authenticate users. -

    -
    +

    Configure Okta as a Certificate Authority for Windows using Workspace ONE

    +

    Configuring a Certificate Authority (CA) allows you to issue client certificates to your targeted Windows devices. This topic describes how to create a static SCEP profile in Workspace ONE and generate a SCEP URL in Okta.

    +

    +

    - Note -

    You can add maximum 100 rules to Office 365 sign on policy, including the Catch-All rule.

    -
    -
    -

    Related topics

    - + Note +

    To configure a delegated (dynamic) SCEP challenge type for Windows using Microsoft Intune, see Configure Okta as a Certificate Authority for Windows using Intune

    +

    +

    +

    Before you begin

    +

    Make sure you have access to the Okta Admin Console.

    +

    Start this procedure

    + +

    Task 1: In Okta, download the x509 certificate

    +

    The x509 certificate you download from Okta is the Organization Intermediate certificate.

    +
      +
    1. In the Admin Console, go to Security > Device Management.
    2. +
    3. Click the Certificate Authority tab.
    4. +
    5. Click the Download icon for Okta CA in the Action column to download the x509 certificate. You will upload the certificate to Workspace ONE in Task 5.
    6. +
    +

    Task 2: In Okta, configure management attestation, generate a SCEP URL and a Secret Key

    +
      +
    1. In the Admin Console, go to Security > Device Management. +
    2. +
    3. + Click the Device Management tab. + + + +
      Note

      Don't click the Certificate Authority tab. It's not used in this procedure.

    4. +
    5. Click Add Platform.
    6. +
    7. Select Desktop (Windows and macOS only).
    8. +
    9. Click Next.
    10. +
    11. In Configure management attestation:
      1. Certificate authority: Select Use Okta as certificate authority.
      2. SCEP URL challenge type: Select Static SCEP URL.
      3. Click Generate.
      4. Copy and save the Okta SCEP URL and the Secret key. You will paste these in Workspace ONE in Task 3. + + + +
        Note

        Make sure to save the SCEP URL and Secret Key as this is the only time they will appear in Okta.

      5. Click Save.
    12. +
    +

    Task 3: In Workspace ONE, create a static SCEP profile

    +

    Configure the Okta CA as a Certificate Authority in Workspace ONE so you can push certificate profiles through the management channel.

    +
      +
    1. + Log in to Workspace ONE as an administrator. +
    2. +
    3. + Click Devices. +
    4. +
    5. Expand Certificates. + + +
    6. +
    7. Select the Certificate Authorities tab.
    8. +
    9. Click + Add and configure settings:
      1. Enter a name and (optionally) a description.
      2. Authority type: Generic SCEP.
      3. SCEP Provider: Basic is entered automatically and can't be changed.
      4. SCEP URL: Copy and paste the SCEP URL you generated in Task 2.
      5. Challenge Type: Static.
      6. Static Challenge: Copy and paste the Secret Key you generated in Task 2.
      7. Max Retries When Pending: Accept the default (5) or specify a different number of retries the system allows while the authority is pending.
      8. Enable Proxy: Accept the default (Disabled) or select Enabled if appropriate for your environment. If you select Enabled, Workspace ONE UEM acts as a proxy between the device and the SCEP endpoint defined in the CA configuration.
    10. +
    11. Click Test Connection. If you select Save before Test Connection, the error Test is unsuccessful appears.
    12. +
    13. After the Test is successful message appears, click Save and Add Template. + +

      If the test doesn't succeed, make sure that the SCEP URL you pasted in this task is the same URL you generated in Task 2.

    14. +
    +

    Task 4: In Workspace ONE, Add/Edit a Certificate Template

    +

    In this task you'll add a CA request template after you create a static SCEP profile in Task 3.

    +
      +
    1. If not already, + log in to Workspace ONE as an administrator. +
    2. +
    3. In Certificate Template, configure settings:
      1. Enter a name and (optionally) a description.
      2. Certificate Authority: Select the CA you created in Task 3.
      3. Issuing Template:  Leave blank or configure as appropriate for your implementation.
      4. Subject Name: CN = {EmailUserName} managementAttestation {DeviceUid}
      5. Private Key Length: 2048
      6. Private Key Type: Signing
      7. SAN Type: N/A.
      8. Automatic certificate renewal: Disabled
      9. Publish Private Key: Disabled
    4. +
    5. Click Save.
    6. +
    +

    Task 5: In Workspace ONE, define a device profile to deploy the Okta Intermediate CA to the Intermediate Store on devices

    +
      +
        +
      1. + If not already, log in to Workspace ONE as an administrator. +
      2. +
      3. + Click Devices. +
      4. +
      5. Expand Profiles and Resources.
      6. +
      7. Click Profiles.
      8. +
      9. In the Add drop down, select Add profile.
      10. +
      11. Select Windows > Windows Desktop > Device Profile.
      12. +
      13. In the General tab, configure settings:
        1. Enter a name and (optionally) a description.
        2. Deployment: Managed
        3. Assignment Type: Accept the default or configure as appropriate for your implementation.
        4. Allow Removal: Accept the default or configure as appropriate for your implementation.
        5. Managed By: Enter the person or group with administrative access to the profile.
        6. Smart Groups: Begin typing the name of the group and then select it from the list.
        7. Exclusions: Allows you to exclude groups from the profile. Accept the default or configure as appropriate for your implementation.
        8. Additional Assignment Criteria: Allows you to schedule a deployment schedule.
        9. Removal Date: Allows you to specify a date when the profile is removed from the device.

      14. +
      15. Click Credentials in the left pane and configure settings:
        1. Credential Source: Upload.
        2. Certificate: Click Upload and browse to the certificate you downloaded in Task 1.
        3. Key Location: Accept the default or configure as appropriate for your implementation.
        4. Certificate Store: Intermediate.
      16. +
      17. Click Save and Publish.
      18. +
      +
    +

    Task 6: In Workspace ONE, define a user profile to deploy the Okta CA-issued client certificate to the Personal Store on devices for management attestation

    +

    This task creates the management payload that pushes the client certificate information and credential to the client, allowing the client to connect to Okta and request a new client certificate. The client certificate is used for management attestation as part of Okta Verify-enabled flows.

    +
      +
        +
      1. If not already, + log in to Workspace ONE as an administrator. +
      2. +
      3. + Click Devices. +
      4. +
      5. Expand Profiles and Resources.
      6. +
      7. Click Profiles.
      8. +
      9. In the Add drop down, select Add profile.
      10. +
      11. Select Windows > Windows Desktop > User Profile.
      12. +
      13. In the General tab, configure settings:
        1. Enter a name and (optionally) a description.
        2. Deployment: Managed
        3. Assignment Type: Accept the default or configure as appropriate for your implementation.
        4. Allow Removal: Accept the default or configure as appropriate for your implementation.
        5. Managed By: Enter the person or group with administrative access to the profile.
        6. Smart Groups: Enter the same group(s) that you specified in Task 5.
        7. Exclusions: Allows you to exclude groups from the profile. Accept the default or configure as appropriate for your implementation.
        8. Additional Assignment Criteria: Allows you to schedule a deployment schedule.
        9. Removal Date: Allows you to specify a date when the profile is removed from the device.

      14. +
      15. Click Credentials in the left pane and configure settings:
        1. Credential Source: Defined Certificate Authority.
        2. Certificate Authority: Select the same Certificate Authority that you configured in Task 3 .
        3. Key Location: Select TPM if Present to support devices with or without TPM.
        4. Certificate Store: Personal.
      16. +
      17. Click Save and Publish.
      18. +
      +
    +

    Task 7: On a Windows computer, verify the certificate installation

    +

    Verify client certificate installation

    +
      +
    1. On the Windows computer, click Start and type cert and then click Manage user certificates.
    2. +
    3. Look in Personal > Certificates.
    4. +
    +

    Verify Certificate Authority

    +
      +
    1. On the Windows computer, click Start and type cert and then click Manage user certificates.
    2. +
    3. Look in Intermediate Certificate Authority > Certificates.
    4. +
    5. In Issued To, find and double click Organization Intermediate Authority.
    6. +
    7. See Issued By: Organization Root Authority.
    8. +
    +

    Next step +

    +

    Add an app sign on policy for Device Trust on Identity engine +

    Top

    @@ -404,27 +487,27 @@

    Related topics

    - - - + - - - -

    diff --git a/en/oie/Content/Topics/identity-engine/devices/prevent-open-ov-prompt.htm b/en/oie/Content/Topics/identity-engine/devices/prevent-open-ov-prompt.htm index ba00fc8619a..dffe6fcf9f3 100644 --- a/en/oie/Content/Topics/identity-engine/devices/prevent-open-ov-prompt.htm +++ b/en/oie/Content/Topics/identity-engine/devices/prevent-open-ov-prompt.htm @@ -1,5 +1,5 @@ - + @@ -16,6 +16,8 @@ + + @@ -75,6 +77,26 @@ })(window,document,'script','dataLayer','GTM-KXMLV58'); /* ]]> */ +
    @@ -331,8 +353,6 @@

    Allow end users to prevent the Open - + +
    @@ -382,8 +404,6 @@

    Option 1: Install without specifying the log level

    EXE

    - + +

    @@ -273,10 +295,6 @@

    View device state and context

    The Devices page displays granular information about the registered devices in your organization.

    -

    Known issues

    -
      -
    • The Devices tab in a user's profile can display only up to 20 devices even if the actual number of devices linked to a user exceeds 20.
    • -

    What you can view in Devices

    Top
    @@ -439,8 +459,6 @@

    Related topics

    - + +
    @@ -305,16 +327,17 @@

    Mandatory tasks

    -

    Configure the Certificate Authority appropriate for your implementation. You can provide your own CA or use Okta as a CA. Identity engine

    +

    Configure a Certificate Authority for your implementation. You can provide your own CA or use Okta as a CA. Identity engine

    -

    Use Okta as a CA or provide your own PKI/CA infrastructure; configure management attestation.

    Use Okta as a Certificate Authority options

    Windows

    @@ -425,8 +448,6 @@

    Related topic

    - + +
    @@ -392,8 +414,6 @@

    Related topic

    - + +
    @@ -334,8 +356,6 @@

    Topics

    - + +
    @@ -367,8 +389,6 @@

    Topics

    - + +
    @@ -393,8 +415,6 @@

    Authentication scenarios

    - + +
    @@ -416,8 +438,6 @@

    Related topics

    - + +
    @@ -352,8 +374,6 @@

    Related topics

    - + +
    @@ -429,8 +451,6 @@

    Related topics

    - + +
    @@ -346,8 +368,6 @@

    Topics

    - + +
    @@ -371,8 +393,6 @@

    Related topics

    - + +
    @@ -269,7 +291,7 @@

    Identi

    Configure Okta sign-on policies and app sign-on policies to enforce assurance and set up passwordless authentication.

    -

    Devices +

    Device administration

    A platform service of the Okta Identity Cloud that offers visibility into devices that access Okta.

    @@ -336,17 +358,15 @@

    Identi

    - + - diff --git a/en/oie/Content/Topics/identity-engine/oie-ov-release-notes.htm b/en/oie/Content/Topics/identity-engine/oie-ov-release-notes.htm index af2ad99e203..52ce1e9c441 100644 --- a/en/oie/Content/Topics/identity-engine/oie-ov-release-notes.htm +++ b/en/oie/Content/Topics/identity-engine/oie-ov-release-notes.htm @@ -17,6 +17,8 @@ + + @@ -76,6 +78,26 @@ })(window,document,'script','dataLayer','GTM-KXMLV58'); /* ]]> */ +
    @@ -438,8 +460,6 @@

    Version: 1.3.1

    - + +
    @@ -681,8 +703,6 @@

    Release: 2020.09.3

    - + +
    @@ -337,8 +359,6 @@

    Additional resources

    - + +
    @@ -496,8 +518,6 @@

    Related topics

    - + +
    @@ -612,8 +634,6 @@

    Related topics

    - + +
    @@ -281,8 +303,7 @@

    Topics

     

     

    @@ -339,8 +360,6 @@

    Topics

    - + +
    @@ -373,8 +395,6 @@

    Topics

    - + +
    @@ -371,8 +393,6 @@

    Topics

    - + +
    @@ -346,8 +368,6 @@

    Topics

    - + +
    @@ -349,8 +371,6 @@

    Topics

    - + +
    @@ -421,8 +443,6 @@

    Related topics

    - + +
    @@ -355,8 +377,6 @@

    Related topics

    - + +
    @@ -398,8 +420,6 @@

    Related topics

    - + +
    @@ -511,8 +533,6 @@

    Related topics

    - + +
    @@ -331,8 +353,6 @@

    Update a Profile Enrollment policy

    - + +
    @@ -366,8 +388,6 @@

    Related topics

    - + +
    @@ -357,8 +379,6 @@

    Related topics

    - + +
    @@ -367,8 +389,6 @@

    Update a Profile Enrollment policy

    - + +
    @@ -375,8 +397,6 @@

    Update a Profile Enrollment policy

    - + +
    @@ -334,8 +356,6 @@

    Configure passwordless authentication with email magic link

    - + +
    @@ -352,8 +374,6 @@

    Related topics

    - + +
    @@ -338,8 +360,6 @@

    Enable Active Directory delegated authentication - +