Okta_Device

A device registered in Okta, such as a mobile phone or a computer

Overview

Devices in Okta represent the physical or virtual devices that users use to authenticate and access the Okta organization. Devices can optionally be managed by 3rd party MDM solutions, which allow administrators to enforce security compliance policies.

Devices are represented as Okta_Device nodes in BloodHound.

Edges

The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Edge Type	Source Node Types	Traversable
Okta_Contains	Okta_Organization	✅
Okta_MobileAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_OrgAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_ResourceSetContains	Okta_ResourceSet	✅
Okta_ScopedTo	Okta_RoleAssignment	❌

Outbound Edges

Edge Type	Destination Node Types	Traversable
Okta_DeviceOf	Okta_User	❌

Properties

Name	Source	Type	Description
id	device.uuid + "@" + oktaDomain or device.id	string	Unique device identifier (derived from hardware ID + domain).
name	device.resourceDisplayName	string	Device display name from Okta.
displayName	device.resourceDisplayName	string	Display label used in BloodHound.
oktaDomain	Collector context (non-API)	string	Okta organization domain where the device exists.
oktaId	device.id	string	Original Okta device identifier (stored for reference).
created	device.created	datetime	Device record creation timestamp.
lastUpdated	device.lastUpdated	datetime	Last update timestamp.
status	device.status	string	Device lifecycle/status value.
resourceType	device.resourceType	string	Okta device resource type.
platform	device.profile.platform	string	Device platform/OS family.
manufacturer	device.profile.manufacturer	string	Hardware vendor/manufacturer.
model	device.profile.model	string	Device model name.
osVersion	device.profile.osVersion	string	Operating system version.
registered	device.profile.registered	bool	Whether the device is registered in Okta.
secureHardwarePresent	device.profile.secureHardwarePresent	bool	Indicates secure hardware support (for example Secure Enclave/TPM).
jailBreak	device.profile.integrityJailbreak	bool	Device jailbreak/root integrity signal.
udid	device.profile.udid	string	Apple UDID for iOS devices.
objectSid	device.profile.sid	string	SID attribute for Windows/AD-linked devices.
serialNumber	device.profile.serialNumber	string	Device serial number, when provided and non-empty.

Sample Property Values

Windows device:

id: [e-mail]
name: PC01
displayName: PC01
oktaDomain: contoso.okta.com
oktaId: guoxrzqh8jBxYxEeJ697
created: 2025-11-25T11:01:53+00:00
lastUpdated: 2026-02-17T08:55:45+00:00
status: ACTIVE
resourceType: UDDevice
platform: WINDOWS
manufacturer: Dell Inc.
model: XPS 14 9440
osVersion: 10.0.26200.7623
registered: true
secureHardwarePresent: true
jailBreak: false
udid: 4C4C4544-0057-4C10-8057-C8C04F573934
objectSid: S-1-5-21-1084505731-826279434-3585917670
serialNumber: HWLWW94

iOS device:

id: guowq18eyhZaDlkkA697
name: John's iPhone
displayName: John's iPhone
oktaDomain: contoso.okta.com
oktaId: guowq18eyhZaDlkkA697
status: ACTIVE
resourceType: UDDevice
platform: IOS
manufacturer: APPLE
model: iPhone17,1
osVersion: 18.6.2
registered: true
secureHardwarePresent: true
jailBreak: false
created: 2025-10-23T17:16:46+00:00
lastUpdated: 2025-10-23T17:16:47+00:00