---
title: "Okta Device Trust: Configuring the Okta Verify Library Item"
slug: "okta-device-trust-configuring-the-okta-verify-library-item"
updated: 2025-07-22T20:03:14Z
published: 2025-07-22T20:03:14Z
canonical: "support.kandji.io/okta-device-trust-configuring-the-okta-verify-library-item"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta Device Trust: Configuring the Okta Verify Library Item

After configuring the [Okta Device Trust (ODT) Integration](/v1/docs/okta-device-trust-integration-setup) in Kandji, the Okta Verify Library item (distributed from ABM or ASM) is used to deploy ODT to your Apple devices. After turning on ODT, required settings, configurations, and resources will be applied to this Library item and deployed automatically to devices in scope.

> [!NOTE]
> For macOS, the downloadable package of Okta Verify is not compatible with the ODT integration. [Okta recommends deploying Okta Verify](https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/ov-install-options-macos.htm) via Apple Business Manager or Apple School Mananger.

### Prerequisites

- The Okta Verify Apple App Store app must be assigned to Kandji via Apps and Books in [Apple Business Manager](https://business.apple.com/) or [Apple School Manager](https://school.apple.com/).

### Configuring Okta Verify for ODT

1. In Kandji, go to the **Library**.
2. Find and click on the **Okta Verify** App Store app in the App Store Apps section. You can use the search option to narrow down the results if you have many apps in your Library.
3. Assign the Library item to one or more Blueprints. If this is the first time deploying ODT, it is a good idea to deploy to a test blueprint scoped to a limited number of devices so that you can see how it functions when deployed.
4. For the installation type, choose **Install and continuously enforce**. If Okta Verify is already installed on some devices, this process will not reinstall the app, but Kandji will take over the management of the app.
5. In the **Okta Device Trust** section, click the ![drawing](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kgapbkxzh70p2zow7l2hem3ufiq_ho3zoa.png) to turn on ODT.
6. You will see a modal letting you know that Managed AppConfig for iPhone and iPad will be disabled in the library item and will be managed by the ODT integration. Click **Yes, turn on Okta Device Trust** to continue.
7. Once turned on, you will see the device families that are configured for ODT and the configured Okta domain.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/DYavmU38cR33pRAY2c-o9XNsIs2uzYN0aA.jpeg)
8. Click **Save**.

### What settings are deployed to devices

Once ODT is set up, enabled, and scoped to your blueprints, the following settings payloads are automatically configured and delivered to Apple devices in the scope of Okta Device Trust in Kandji.

| Payload setting | Platform | Description |
| --- | --- | --- |
| Dynamic SCEP challenge certificate | macOS | This is a unique Okta SCEP certificate per device. The certificate is used in the device registration process and will automatically renew when it expires. |
| OktaVerify.EnrollmentOptions | macOS | Okta Verify `SilentEnrollmentEnabled` configuration is sent to macOS devices. This will launch Okta Verify automatically if an unregistered device attempts to access Okta resources and prefill the Organization URL for the user. |
| Okta Verify Login item | macOS | This payload adds Okta Verify as a login item on macOS and will start Okta Verify at user login. |
| Managed app config | iOS and iPadOS | This App Config contains the `OktaVerify.OrgUrl` and device `managementHint` used to register the device as managed in Okta. |
| SSO Extension payload | macOS, iOS, and iPadOS | The SSO extension forwards requests from the browser or app to Okta Verify, and users do not receive the Open Okta Verify browser prompt. Not supported on Chrome or Firefox. |