ROLE REQUIRED
Okta Super Administrator
Authentication policies define and enforce access requirements for apps. Following ZeroTek best practices, most apps are well secured using the Any Two Factors default policy.
For applications requiring a higher level of access control, this procedure creates a dedicated authentication policy that enforces Device Trust — requiring managed device authentication and denying access to anyone who doesn't meet the criteria.
This procedure has two phases:
Phase 1 — Test configuration: You will create the policy and its rules, then assign a test application and a test group to validate that Device Trust is working correctly.
Phase 2 — Production configuration: Once testing is complete, you will remove the test group from the policy rules and add the production applications that should be governed by Device Trust.
BEFORE YOU BEGIN
As part of ZeroTek's Okta Device Trust Setup guide. It assumes you have completed all prior procedures in the guide.
Before starting, identify or create a group in ZeroTek to use for testing Device Trust and add the members you want to use for testing. Following ZeroTek's naming conventions, the group might be called "Policy - Device Trust".
IMPORTANT
Modifying Okta authentication policies is a Protected Action in Okta. Before starting this procedure you must be logged into the Okta Admin Console using either the MSP-Okta Integration account or another secure break-glass account that has Okta Super Administrator privileges.
Okta will prompt you to re-authenticate every time you create or modify an authentication policy rule. This is expected behavior.
Phase 1: Test configuration
Create the authentication policy
In the Okta Admin Console, click Security > Authentication Policies.
Click Add a policy.
In the Name field, type a name for the policy. This article will refer to this policy as "Critical Apps". Optionally add a description, then click Save.
Create a Device Trust requirements rule
Click Add rule.
In the Rule name field, type a name. This article will refer to this rule as "Device Trust - Requirements Rule".
In the User's group membership dropdown, select At least one of the following groups, then assign the name of the group you created for device trust (possibly "Policy - Device Trust").
For Device management is, select Registered and Managed.
For Possession factor constraints, select Require user interaction only.
For the authentication prompt, select When an Okta global session doesn't exist, then click Save.
Create an Any Two Factors rule
During testing, this rule ensures users not in the Device Trust test group can still access applications assigned to this policy.
Click Add rule.
In the Rule name field, type a name. This article will refer to this rule as "Any Two Factor - Non Test Users"
For Possession factor constraints, select Require user interaction.
For the authentication prompt, select When an Okta global session doesn't exist, then click Save.
Create a deny rule and confirm rule order
Beside the existing Catch-all Rule, click Actions > Edit.
In the Access is area, click Denied, then click Save.
Confirm the rules are in the following order:
Device Trust - Requirements Rule
Any Two Factor - Non Test Users
Catch-all Rule
Assign a test application and test
Click the Applications tab, then click Add app.
Click Add beside the application you want to test with, and then click Done.
Confirm the application is assigned to the Critical Apps policy.
Sign in to the test application using an account from the Device Trust test group and verify access is granted.
Sign in from an untrusted or unmanaged device and verify access is blocked.
Phase 2: Production configuration
Once testing is complete and you are satisfied Device Trust is working correctly:
In the Device Trust - Requirements Rule, remove the test group from the User's group membership field. With no group restriction in place, the rule will apply to all users accessing applications assigned to this policy.
Add any additional applications that should be governed by Device Trust to the Critical Apps policy via the Applications tab.
Need help? Contact ZeroTek Support at support@zerotek.com.