> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform SSO with Okta

> Integrate Okta as the authentication provider for managed Mac devices using Apple's Platform Single Sign-On so employees log in with their Okta credentials and SSO propagates to all Okta-connected apps.

## Platform compatibility

| macOS | Windows | Linux | iOS / iPadOS | Android |
| ----- | ------- | ----- | ------------ | ------- |
| ✅     |         |       |              |         |

## How to set it up

<Steps>
  <Step title="Add the Platform Single Sign-On application in Okta">
    1. Go to **Admin Console > Applications > Applications > Browse App Catalog**
    2. Search for **Platform Single Sign-On for macOS**
    3. Click **Add integration**

       > If the message *This feature isn't enabled* appears, contact your Okta Account Manager to enable Okta Device Access (paid feature).
    4. Open the app from your application list
    5. In the **General** tab, rename the app label if needed
    6. In the **Sign On** tab, make note of the **Client ID** (required for MDM configuration)
    7. In the **Assignments** tab, assign the app to the relevant users or groups
  </Step>

  <Step title="Create a SCEP challenge in Okta">
    1. Go to **Admin Console > Security > Device integrations**
    2. Ensure the **Device Access** tab is visible (next to *Endpoint Management*)

       > If the tab is missing, Okta Device Access is not yet enabled
    3. Add a **Static SCEP certificate authority**
    4. Make note of the following:
       * **SCEP certificate URL**
       * **SCEP certificate challenge**
  </Step>

  <Step title="Add Okta Verify to Fleet">
    1. From the Okta Admin Console, go to **Settings > Downloads**
    2. Download **Okta Verify for macOS**
    3. Add the app to Fleet as software:
       * Upload the application file
       * Do not enable automatic deployment or self-service
       * **Primo will automatically adjust settings to handle deployment**
  </Step>

  <Step title="Save key information for MDM configuration">
    Make sure to save the following details for the next step:

    * **Okta domain** (e.g. `yourorganization.okta.com`)
    * **Client ID** (from the Platform Single Sign-On application)
    * **SCEP certificate URL**
    * **SCEP certificate challenge**
  </Step>

  <Step title="Finalize the deployment in Primo">
    Go to a profile: [https://app.getprimo.com/profiles](https://app.getprimo.com/profiles)

    1. Enable the **Okta Platform SSO** setting
    2. Enter the required information (domain, Client ID, SCEP URL, and Challenge)
    3. Save the changes

    Okta Platform SSO will then be activated on all devices targeted by the profile.

    <Info>
      The deployment may take several minutes to complete, as Okta Verify must be installed on all targeted devices.
    </Info>
  </Step>
</Steps>