Home » Integrating Okta
Category Filter
 
 

Last updated: August 13, 2026

Integrate Okta with MDM 

This page guides MDM administrators through integrating Okta, a cloud-based identity and access management solution, with the MDM server. The integration enables Single Sign-On (SSO) for the MDM console and AD-based authentication during device enrollment. The step-by-step procedure covers configuring OAuth app details in the Okta Admin portal, creating an OIDC app integration, generating Client ID and Client Secret credentials, enabling Federation Broker Mode to sync all Okta users, and granting the required API scopes.

Okta, is a cloud based identity and access management solution that provides directory services to make device enrollment and user management simpler. By integrating Okta with MDM, you can enable Single Sign On for users to login to the MDM console, AD based authentication etc.

Integration Procedure

You need to follow the steps below to integrate your Okta directory with MDM:

  1. On the MDM console, navigate to Enrollment > Directory Services.
  2. Click on Add Domain and select Okta.
  3. Sign in to your Okta organization as a user with administrator privileges.
  4. Provide Org URL from the top right corner of your dashboard (excluding "https://"). Your Org URL will look like this:
    • example.oktapreview.com
    • example.okta.com
    • id.example.com, if you have configured a custom URL domain.

Okta URL domain examples for ManageEngine MDM Okta integration

Okta custom URL domain configuration for MDM server

  1. If OAuth is not configured, you will get an error message saying "OAuth App details are not yet configured". Click on here to configure OAuth.
  2. Click on Admin to navigate to the Okta Admin portal.

ManageEngine MDM server showing OAuth App not configured - link to configure Okta

  1. Go to Applications and then click on Create App Integration.

Okta Admin portal - Create App Integration for MDM OAuth

Okta OIDC Web Application selection for MDM integration

  1. Select OIDC - OpenID Connect as Sign-in method and Web Application as Application type.
  2. Click on Next.
  3. Enable Refresh Token option and enter the Redirect URI obtained from the MDM server.

Okta app redirect URI and Refresh Token settings for ManageEngine MDM

  1. Under Assignments choose the appropriate option as applicable.

Okta application assignment options configuration for MDM

  1. Upon clicking Save, a new set of Client ID and Client Secret will be generated which is to be copied and pasted back on the MDM server.

Okta Client ID and Client Secret generated for ManageEngine MDM server

  1. Federation Broker Mode must be enabled to sync all Okta users with the MDM server.

Okta Federation Broker Mode enabled to sync all users with MDM server

  1. Under Okta API scopes, grant the following oAuth scope permissions:
    • okta.groups.read
    • okta.users.read
    • okta.users.read.self

Okta API scopes - okta.groups.read and okta.users.read permissions for MDM

  1. Once you have entered the Client ID and Client Secret on the MDM server, click on Integrate.

Now the Okta will be successfully integrated with the MDM server. After this, you can make use of Okta credentials for authenticating users during enrollment and allowing users to login to the MDM console via Single Sign-On (SSO).

 

Frequently asked questions

What is my Okta Org URL?
Your Org URL appears in the top right corner of your Okta dashboard, and looks like example.oktapreview.com, example.okta.com, or a custom domain such as id.example.com.

What Okta API scopes are required for MDM integration?
You need to grant okta.groups.read, okta.users.read, and okta.users.read.self.

Why do I need to enable Federation Broker Mode?
Federation Broker Mode must be enabled to sync all Okta users with the MDM server.

What can I do after integrating Okta with MDM?
Once integrated, you can use Okta credentials to authenticate users during enrollment and allow users to log in to the MDM console via Single Sign-On (SSO).

 

Jump To