Enforce cryptographic endpoint checks inside your existing identity provider, correlate health signals from EDR and MDM tools, and stream audit telemetry directly into your GRC and SIEM platforms.
Register DeviceTrust as a Custom OIDC IdP Factor in Okta Identity Engine (OIE) authentication policies for per-app step-up posture enforcement and SCIM group sync.
Enforce cross-platform macOS, Linux, and contractor Windows posture inside Conditional Access policies via External Authentication Methods (EAM) without requiring Intune join.
Wrap Google Workspace SAML sign-ins to verify FileVault, BitLocker, OS patch currency, and hardware-bound keys before granting Gmail, Drive, and Cloud Console sessions.
Chain hardware key challenges and endpoint posture claims into hybrid enterprise authentication trees with sub-50ms claim signing latency.
Verify that the Falcon sensor daemon is running, tamper protection is armed, and CrowdStrike Zero Trust Assessment (ZTA) scores exceed your minimum threshold.
Confirm active behavioral engine state, anti-tamper lock status, and management console heartbeat freshness before issuing production cloud tokens.
Validate real-time protection, cloud-delivered signature currency (≤ 48h), and tamper protection across corporate and contractor Windows 11 endpoints.
Deploy the lightweight DeviceTrust agent silently via MDM configuration profile, then correlate MDM enrollment status with live osquery checks at sign-in.
Bridge cross-platform gaps by pairing Intune Windows management with unified posture policies covering Linux engineering laptops and contractor BYOD fleets.
Proactively message employees when an OS security update or disk encryption check enters its grace period, letting them fix issues days before any login block occurs.
Automatically sync full-disk encryption, screen-lock timeout, and antivirus compliance evidence across Mac, Windows, and Linux directly into SOC 2 and ISO 27001 audits.
Stream every authentication posture verdict and osquery differential table snapshot to your security data lake in Open Cybersecurity Schema Framework (OCSF) format.
Every authentication decision produces a cryptographically signed OIDC token for your identity provider and a structured JSON audit record for your detection engineering pipeline, eliminating proprietary binary log formats.
Correlate device serial numbers, hardware key thumbprints, and failing check IDs alongside Okta System Log and AWS CloudTrail events.
Manage sign-in policies, osquery check packs, and grace period schedules as version-controlled code in Git.
{
"event_id": "evt_01J9X9R7W8K3M2",
"timestamp": "2026-11-12T18:42:11.204Z",
"tenant": "northstar-fintech",
"idp_connection": "okta_oie_prod",
"target_application": "GitHub Enterprise Cloud",
"actor": { "email": "mchen@northstar.io" },
"device": {
"device_id": "dev_98a4f21c",
"hostname": "mchen-mbp16.corp",
"os": "macOS 15.3.1",
"hardware_attestation": "APPLE_SECURE_ENCLAVE_P256",
"disk_encrypted": true,
"edr_sensor": "crowdstrike_falcon_7.20.18402"
},
"verdict": "ALLOW",
"evaluated_checks": 14,
"failed_checks": []
}
DeviceTrust uses passwordless Single Sign-On federated through your organization's identity provider: