Okta Verify configurations for macOS devices

You can use your device management solution (MDM) to deploy Okta Verify configurations to domains.

Configuration options enable different aspects of Okta Verify functionality.

Configuration options

Use the following keys and values to configure Okta Verify:

• OktaVerify.DeviceHealthOptions

• OktaVerify.EnableOSQueryCustomChecks

• OktaVerify.EnrollmentOptions

• OktaVerify.LaunchOptions

• OktaVerify.OrgUrl

• OktaVerify.OSQueryAllowedDomains

• OktaVerify.Plugins

• OktaVerify.ReportDiagnostics

OktaVerify.DeviceHealthOptions

Hide the Device Health page or hide specific health checks in Okta Verify on user devices.

If you select multiple values, separate them by a semicolon. For example, HideOSUpdate;HideDiskEncryption hides the OS update and disk encryption checks. All other device checks are shown.

If the value contains Disabled, Okta Verify doesn't display the Device Health page.

By default (when no values are set), Okta Verify displays all device health checks on user devices.

Example.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.DeviceHealthOptions</key>
    <string>HideDiskEncryption;HideBiometrics</string>
</dict>
</plist>

OktaVerify.EnableOSQueryCustomChecks

Specifies whether custom OSQuery checks can be run on this device.

Example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.EnableOSQueryCustomChecks</key>
    <true/>
</dict>
</plist>

OktaVerify.EnrollmentOptions

Configure whether users are prompted to enroll in Okta Verify. You can reduce the number of user prompts or control the rollout of Okta Verify and Okta FastPass in your org.

Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.EnrollmentOptions</key>
    <string>Enabled</string>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.LaunchOptions</key>
    <string>HideMainWindow</string>
</dict>
</plist>            

OktaVerify.OrgUrl

Pre-populate the org URL so that users don't have to enter this value on the First, enter your sign-in URL page.

This option is available in Okta Verify 2.4.1 and later.

Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.OrgUrl</key>
    <string>atko.okta.com</string>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.OSQueryAllowedDomains</key>
    <string>my-test-domain.oktapreview.com;my-prod-domain.oktapreview.com</string>
</dict>
</plist>

OktaVerify.Plugins

Enable Okta Verify to collect trust signals from an EDR client that's running on the same macOS device. See Manage endpoint security integration plugins for macOS.

Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<managedAppConfiguration>
<dict>
    <key>OktaVerify.Plugins</key>
    <array>
        <string>com.crowdstrike.zta</string>
    </array>
    <key>com.crowdstrike.zta</key>
    <dict>
        <key>description</key>
        <string>File-based EDR integration between Okta Verify and the CrowdStrike Falcon agent.</string>
        <key>format</key>
        <string>JWT</string>
        <key>location</key>
        <string>/Library/Application Support/Crowdstrike/ZeroTrustAssessment/data.zta</string>
        <key>name</key>
        <string>com.crowdstrike.zta</string>
        <key>type</key>
        <string>FILE</string>
    </dict>
</dict>
</managedAppConfiguration>
</plist>

OktaVerify.ReportDiagnostics

Configure whether Okta Verify diagnostic and crash information is shared with Okta.

If this option isn't configured, end users can set this value on their app. See Share diagnostic information with Okta from your macOS device.

Example

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>OktaVerify.ReportDiagnostics</key>
    <true/>
</dict>
</plist>