# Integrate Okta with MDM

Last updated: August 13, 2026

This page guides MDM administrators through integrating Okta, a cloud-based identity and access management solution, with the MDM server. The integration enables Single Sign-On (SSO) for the MDM console and AD-based authentication during device enrollment. The step-by-step procedure covers configuring OAuth app details in the Okta Admin portal, creating an OIDC app integration, generating Client ID and Client Secret credentials, enabling Federation Broker Mode to sync all Okta users, and granting the required API scopes.

Okta is a cloud-based identity and access management solution that provides directory services to make device enrollment and user management simpler. By integrating Okta with MDM, you can enable Single Sign-On for users to log in to the MDM console and AD-based authentication.

## Integration Procedure

You need to follow the steps below to integrate your **Okta directory** with MDM:

1. On the MDM console, navigate to **Enrollment > Directory Services**.
2. Click **Add Domain** and select **Okta**.
3. Sign in to your Okta organization as a user with administrator privileges.
4. Provide the Org URL from the top-right corner of your dashboard, excluding `https://`. Your Org URL will look like this:
   - `example.oktapreview.com`
   - `example.okta.com`
   - `id.example.com`, if you have configured a custom URL domain.

![Okta URL domain examples for ManageEngine MDM Okta integration](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_20.png)

![Okta custom URL domain configuration for MDM server](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_2.png)

5. If OAuth is not configured, you will get an error message saying **"OAuth App details are not yet configured"**. Click **here** to configure OAuth.
6. Click **Admin** to navigate to the Okta Admin portal.

![ManageEngine MDM server showing OAuth App not configured - link to configure Okta](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_3.png)

7. Go to **Applications** and then click **Create App Integration**.

![Okta Admin portal - Create App Integration for MDM OAuth](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_5.png)

![Okta OIDC Web Application selection for MDM integration](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_4.png)

8. Select **OIDC - OpenID Connect** as the sign-in method and Web Application as the **Application type**.
9. Click **Next**.
10. Enable the **Refresh Token** option and enter the **Redirect URI** obtained from the MDM server.

![Okta app redirect URI and Refresh Token settings for ManageEngine MDM](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_6.png)

11. Under **Assignments**, choose the appropriate option as applicable.

![Okta application assignment options configuration for MDM](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_7.png)

12. Upon clicking **Save**, a new set of **Client ID** and **Client Secret** will be generated, which must be copied and pasted back into the MDM server.

![Okta Client ID and Client Secret generated for ManageEngine MDM server](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_8.png)

13. Federation Broker Mode must be enabled to sync all Okta users with the MDM server.

![Okta Federation Broker Mode enabled to sync all users with MDM server](https://www.manageengine.com/mobile-device-management/help/images/okta-integration-10.png)

14. Under Okta API scopes, grant the following OAuth scope permissions:
    - `okta.groups.read`
    - `okta.users.read`
    - `okta.users.read.self`

![Okta API scopes - okta.groups.read and okta.users.read permissions for MDM](https://www.manageengine.com/mobile-device-management/help/images/okta_integration_9.png)

15. Once you have entered the Client ID and Client Secret on the MDM server, click **Integrate**.

Now Okta will be successfully integrated with the MDM server. After this, you can use Okta credentials for authenticating users during enrollment and allowing users to log in to the MDM console via Single Sign-On (SSO).

## Frequently Asked Questions

### What is my Okta Org URL?

Your Org URL appears in the top-right corner of your Okta dashboard and looks like `example.oktapreview.com`, `example.okta.com`, or a custom domain such as `id.example.com`.

### What Okta API scopes are required for MDM integration?

You need to grant `okta.groups.read`, `okta.users.read`, and `okta.users.read.self`.

### Why do I need to enable Federation Broker Mode?

Federation Broker Mode must be enabled to sync all Okta users with the MDM server.

### What can I do after integrating Okta with MDM?

Once integrated, you can use Okta credentials to authenticate users during enrollment and allow users to log in to the MDM console via Single Sign-On (SSO).