# How to attain Okta Device Attestation for macOS devices? Last updated: July 24, 2026 Mobile Device Manager Plus attests macOS devices for Okta SSO and Device Trust by deploying management attestation certificates over SCEP. Admins generate an SCEP URL and secret key in Okta, create a matching CA server and certificate template in the MDM console, then build and associate an SCEP profile with target devices. Distributing the Okta Verify app and having the user sign in once with their credentials completes the attestation. Managed devices should be attested by Okta for provisioning SSO extension with Okta and Okta Device Trust. In the case of macOS devices, attestation is achieved by Mobile Device Manager Plus by distributing management attestation certificates to the device through SCEP. ## Overview In order to obtain device attestation for **macOS** devices, **management attestation certificates** are deployed to the device. First an **SCEP URL** and **Secret key** must be generated in Okta by the administrator or technician, which will then be used to create a **Certificate Server** and **Template** in the MDM console. The next step is to generate and associate an SCEP profile to the device using the Certificate Template. After that, in order to get the device attested, the Okta Verify app has to be distributed to the devices and the user should set up their account and log in once with their organization **credentials**. ![How to attain Okta Device Attestation for macOS devices? illustration 3](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-Flowchart-2.png) Follow the detailed steps specified below to configure Okta Device Trust for macOS devices: ### Step 1: Generate an SCEP URL and Secret key First, you have to generate an SCEP URL and Secret key in the Okta by following the steps provided below: ![How to attain Okta Device Attestation for macOS devices? illustration 4](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-mac_1.png) 1. Sign in to the **Okta portal** and go to **Security > Device Integrations**. Then **Select platform** as **Desktop**, and click **Next**. ![How to attain Okta Device Attestation for macOS devices? illustration 5](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-mac_2.png) 2. Select SCEP URL challenge type as **Static SCEP**, and click **Generate**. Then copy the **SCEP URL** and **Secret Key** onto your clipboard, and then click **Save**. ### Step 2: Create a Certificate Server and Template in MDM After generating an **SCEP URL** and **Secret key** in Okta, a **Certificate Server** and **Template** should be created in the MDM console. For this, follow the steps provided below: ![How to attain Okta Device Attestation for macOS devices? illustration 6](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-mac_3.png) 1. On the **MDM console**, go to **Device Management > Certificates > CA Server**, and click on **Add CA Server**. ![How to attain Okta Device Attestation for macOS devices? illustration 7](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-mac_4.png) 2. Keep the server type as **Generic SCEP**, and provide a name for the Certificate Authority. 3. Then **paste** the SCEP URL copied from the Okta in the SCEP URL, click **save** save to proceed. ![How to attain Okta Device Attestation for macOS devices? illustration 8](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-mac_5.png) 4. Here also provide a name for the **SCEP Template**, and under Subject, paste **CN=%devicename% managementAttestation %udid%**. 5. Set the Challenge type as **Static** and for the **Enrollment challenge password** paste the **secret** key copied from Okta. 6. TFhen set the **Key Size** as **2048** and choose **YES** for the options Use as **Digital Signature** and **Use For Key Encipherment**. Finally click **Save** to create the CA Server. ### Step 3: Create an SCEP Profile in the MDM console Next we need to create an SCEP profile to distribute to your managed devices. For that: 1. Go to **Device Mgmt > Profile** and click on **Create Profile** and choose **macOS**. 2. Next provide a suitable name for the profile, and click **Continue**. 3. Choose the SCEP template. 4. Choose to Allow "Private Key Export from Keychain" and "Third Party Apps accessing the Private Key" keys according to your needs. ![How to attain Okta Device Attestation for macOS devices? illustration 9](https://cdn.manageengine.com/mobile-device-management/help/images/okta-mac-7.1.png) 5. Click **Save** and then **Publish**. ### Step 4: Associate the SCEP Profile to the Devices Now the SCEP profile should be associated with the devices by following the steps specified below: 1. Go to **Groups & Devices** under Device Mgmt in the MDM console and select the respective Group(s) or devices you want to associate the SCEP profile. ![How to attain Okta Device Attestation for macOS devices? illustration 10](https://cdn.manageengine.com/mobile-device-management/images/Okta-DA-mac_7.png%20) 2. Click on **Actions > Associate Profile**. Select the SCEP profile and click **Associate**. ### Step 5: Distribute Okta Verify App to the Devices Once the SCEP profile has been associated to the devices, the Okta Verify app should be distributed to the devices. For macOS, the app can be added using [ABM Server tokens](https://www.manageengine.com/mobile-device-management/help/app_management/ios_app_management.html#App_store_App_for_iOS_devices) or using the [Apple Playstore](https://www.manageengine.com/mobile-device-management/help/app_management/mdm_creating_app_repository.html#ios_store_apps) in the MDM App repository. Finally, for the device(s) to attain the attested status, the user should set up Okta Verify with their **user credentials** and log in to any org allotted apps at least once. ## Frequently asked questions ### How does Mobile Device Manager Plus attest macOS devices for Okta? It deploys a management attestation certificate to the device over SCEP — you generate an SCEP URL and secret key in Okta, use them to create a matching CA server and certificate template in the MDM console, then build and associate an SCEP profile with the target devices. ### What subject format does the SCEP certificate template need? Under Subject in the SCEP template, paste CN=%devicename% managementAttestation %udid%, set the Challenge type to Static using the secret key from Okta, and set the Key Size to 2048 with Digital Signature and Key Encipherment enabled. ### Do I need to distribute anything besides the SCEP profile? Yes — after associating the SCEP profile with devices, distribute the Okta Verify app (via ABM server tokens or the Apple Play Store in App Repository) so users can complete setup. ### How is attestation completed on the macOS device? The user sets up Okta Verify with their credentials and signs in to any org-allotted app at least once to reach attested status.