Okta Certified Administrator · Part I

Security

20% of the exam — the third-largest domain.

Security

Module 1: Okta Security Policy & Enforcement Framework

7 sub-topics · this deck covers sub-topic 4 of 7

The Exam Bullet

"Demonstrate knowledge of device concepts including device context, device binding, registered vs. managed devices, and EDR signals"

Some policies from the last sub-topic checked "device state" as a condition. This sub-topic is about what that phrase actually means underneath — how a device gets an identity Okta can check at all.

The Mechanism — Device Registration

Device registration binds an Okta Verify app instance to a device, creating a unique object in the Okta Universal Directory. Users set this up themselves in Okta Verify — admins cannot add devices directly from the Admin Console.

A unique cryptographic key is generated during registration and stored in a hardware-backed keystore (like a TPM or Secure Enclave) or a software-backed one, depending on the device.

Registered vs. Managed — Don't Confuse These

Registered — Okta Verify is installed and an account exists on the device. That's it.

Managed — additionally enrolled through a device management solution, and configured in Security > Device Integrations. Managed is a strictly higher bar than Registered.

The Verification Probes

When a user hits a protected app, Okta checks several device attributes: whether Okta Verify is installed, the registration state, management enrollment, and whether secure hardware is present (TPM, Secure Enclave) along with hardware protection of the proof-of-possession key.

The Honest Gap — EDR Signals

The exam bullet names EDR (Endpoint Detection and Response) signals explicitly, but the device-registration source used here does not mention EDR integration at all. This is flagged as a documented gap rather than filled with an invented mechanism.

The Exam Angle

Watch for scenario questions built around this trap:

→ "A device has Okta Verify installed but isn't satisfying a 'managed device' policy rule." = expected — Registered ≠ Managed; managed requires device-management enrollment too.

One Line To Remember

Device registration binds Okta Verify to a device via a hardware- or software-backed cryptographic key, creating a UD object — self-service only, admins can't add devices manually. Registered = Okta Verify installed; Managed = also enrolled in device management. Okta's probes check install/registration/management/secure-hardware status. EDR signals are named on the exam but weren't documented in this source.

Sources: help.okta.com — device-registration.htm

Next: Sub 5 →