Okta Policy Error for Device Attribute Expressions in Account Management Policy
Last Updated:
Overview
The following error occurs when adding custom expressions that include device attributes, such as device.profile.managed == True, to the Okta Account Management Policy:
This operation isn’t supported in the Okta account management policy
The issue occurs because the policy evaluates account management conditions, not device-based access conditions. After moving device-based conditions to an authentication policy, the administrator enforces managed-device requirements for application access.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Policy
- Management and Monitoring
- Account Management
Cause
The Okta Account Management Policy manages user accounts and authenticator lifecycle operations. Its custom expression support only covers account management functions such as authenticator enrollment and unenrollment, password recovery, and account unlock. Device attributes describe application access conditions, so the policy does not evaluate expressions based on device state, such as whether a device is managed.
Solution
How is the policy error resolved?
Configure device-based conditions in authentication policies to enforce device requirements for application access.
- Use authentication policies, also called sign-on policies, instead of the Okta Account Management Policy when device attributes determine access.
- Define access requirements based on device posture, such as a managed device or trusted device.
- Apply the policy to the specific application that requires the device-based condition.
- Keep the Okta Account Management Policy dedicated to account lifecycle operations such as authenticator enrollment, password recovery, and account unlock.
