Okta Certified Administrator · Part I
Security
20% of the exam — the third-largest domain.
Security
Module 1: Okta Security Policy & Enforcement Framework
7 sub-topics · this deck covers sub-topic 3 of 7
↑ Module 1 Overview
The Exam Bullet
"Demonstrate knowledge of authenticators, authentication methods, AAL (authentication assurance level), and end-user context to configure app-level policies"
Global session policy sets the baseline. This sub-topic is about going one level more granular: policies that apply to a specific app, based on the specific context a user shows up with.
The Mechanism — App Sign-On Policy Rules
Every app sign-on policy starts with a catch-all rule allowing access with any two-factor type. Admins add and prioritize rules on top, each with IF conditions and a THEN outcome.
IF: user type, group, specific users · device state (registered/Okta Verify-enrolled) · device management status · device assurance policies · platform · network zone/IP · risk level · Expression Language conditions
THEN: deny, or allow with specific factor requirements
The Gotcha — Platform Detection
App sign-in policy rules don't recognize a ChromeBook as a ChromeOS platform if the user accesses resources through Firefox or Opera.
A platform-based rule that should match a ChromeBook can silently miss it, purely because of browser choice.
The Honest Gap — AAL
The exam bullet names AAL (Authentication Assurance Level) explicitly, but Okta's own authenticators documentation does not define or use this term. AAL is a general industry/NIST-style concept — a measure of how much confidence a given authentication event provides — not something documented as an Okta-specific configuration setting in the source used here. Treat this as general security knowledge, not a verified Okta fact.
The Exam Angle
Watch for scenario questions built around this trap:
→ "A ChromeOS-specific rule isn't matching some ChromeBook users." = check what browser they're using — Firefox/Opera break platform detection.
One Line To Remember
App sign-on policy rules layer IF (user/group, device state, management status, device assurance, platform, network zone, risk, Expression Language) → THEN (deny or allow with factor requirements) on top of the global session baseline. ChromeBooks accessed via Firefox/Opera won't match ChromeOS platform rules. AAL is named on the exam but not defined in Okta's own docs — treat it as general assurance-level concept, not a documented Okta setting.
Sources: help.okta.com — add-app-sign-on-policy-rule.htm · about-authenticators.htm
Next: Sub 4 →