Forum Discussion
Hybrid Azure AD Join + Okta Federation
Kav77 Providing you details about this:
Please follow controlled HYAADJ rollout using Group Policy Object.
The only change you need to perform related to GPO object is the Tenant.
Use Tenant domain : domain.onmicrosoft.com and not the custom domain name verified to the tenant.
Also, the reason where you see AzureAD PRT = NO, is related to device where Windows device login work on Legacy Auth, so please create a Rule in Okta to allow legacy auth to the PRT token.
Be sure that device is able to communicate to DC and Internet while performing the device registration process.
RIGAN25I wasnt sure what you meant by this initially: "Also, the reason where you see AzureAD PRT = NO, is related to device where Windows device login work on Legacy Auth, so please create a Rule in Okta to allow legacy auth to the PRT token."
Did some digging and found these two resources:
https://www.okta.com/resources/whitepaper/securing-office-365-with-okta/
https://www.youtube.com/watch?v=gvQ8BuxRlkg&ab_channel=Okta
Though I didnt have the option to add a custom agent string, I did add another sign on policy in Okta to allow legacy auth and now my PRT token is generated and device conditional access policies work 🙂
Hopefully this helps someone else that may come across this.
Kav77 Custom User Agent is Early Access, which Okta admins should be able to enable themselves from the Admin UI "Settings>Features". If not available, Okta support can turn it on for you.
https://help.okta.com/en/prod/Content/Topics/Apps/Office365/custom-client-filter.htm
