Employees log in to their Mac with their Okta username and password through Apple Platform SSO, and then reach Okta-connected apps without signing in again. Use it when your company manages identities in Okta.
Feature/Functionality
Overview
This control is for Macs only:
| macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|
| ✅ |
You prepare a few things in the Okta Admin Console first, then create the control in Factorial IT.
How to use
Step 1: Add the Platform Single Sign-On app in Okta
- In Okta, go to
Admin Console > Applications > Applications > Browse App Catalog. - Find Platform Single Sign-On for macOS.
- Click Add integration. If you see This feature isn't enabled, ask your Okta Account Manager to turn on Okta Device Access, which is a paid feature.
- Open the app from your list of applications.
- On the General tab, change the app label if you want to.
- On the Sign On tab, copy the Client ID. The control needs it.
- On the Assignments tab, assign the app to the right employees or groups.
Step 2: Create a SCEP challenge in Okta
- Go to Admin Console > Security > Device integrations.
- Check that the Device Access tab shows up next to Endpoint Management. If it is not there, Okta Device Access is not turned on yet.
- Add a Static SCEP certificate authority.
- Copy these two values:
- SCEP certificate URL
- SCEP certificate challenge
Step 3: Add Okta Verify to the software library
- In the Okta Admin Console, go to Settings > Downloads.
- Download Okta Verify for macOS.
- Add it to the software library:
- Upload the app file.
- Leave automatic deployment and self-service off.
- Factorial IT sets up the deployment for you.
Step 4: Keep the key details at hand
You need these for the control:
-
Okta domain, for example
yourorganization.okta.com - Client ID, from the Platform Single Sign-On app
- SCEP certificate URL
- SCEP certificate challenge
Step 5: Create the control
- Go to MDM > Controls > Add new control.
- Pick Mac login with Okta.
- Enter the domain, the Client ID, the SCEP URL and the challenge.
Step 6: Choose the target
Choose every macOS device, specific device groups or a custom target, then save. Mac login with Okta switches on for every targeted Mac.
Expect the rollout to take a few minutes: Okta Verify has to install on each targeted Mac first.
Tips and Best Practices
- Copy the Client ID and SCEP values as you go. You enter all four details in one go when you create the control.
- Do not turn on automatic deployment or self-service for Okta Verify. Factorial IT handles its deployment itself.
- Assign the Okta app to the right people before you target their Macs.
- Start with a device group. Check a few Macs log in properly, then widen the target.
Troubleshooting and FAQ
Troubleshooting
- Okta shows This feature isn't enabled. Okta Device Access is not part of your Okta plan yet. Ask your Okta Account Manager.
- The Device Access tab is missing in Okta. Okta Device Access is not turned on yet.
- Mac login with Okta is not active straight after saving. Give it a few minutes. Okta Verify has to install on every targeted Mac first.
FAQ
-
Is Okta Device Access included in every Okta plan?
No. It is a paid feature that your Okta Account Manager turns on.
-
Do I need to deploy Okta Verify myself?
No. You upload it to the software library and Factorial IT takes care of the deployment.
-
What details does the control ask for?
Your Okta domain, the Client ID, the SCEP certificate URL and the SCEP certificate challenge.