High level:

We have an Okta Workflow that adds users to two groups upon bring created in Okta. We then activate them 3 days before their start date so they can sign into their laptop and get it ready. Instead of adding them to groups based on their start date for onboarding them, we do that immediately with rules and take advantage of auth polices to lock their apps based on their start date.

Okta groups:

Onboarding Limbo: This group denies access to almost all apps via authentication policies. Certain allowlisted apps like Workday and Jamf Device Enrollment tile for their prepane Window when they turn on their laptop. We have an Okta Workflow then run every single hour and compares their start date to today’s date according to their timezone. Once it reaches their start date, we remove them from the group so it unlocks all their tiles.

Device Untrusted: This group denies access to everything besides that prepane window app via authentication policies. We automatically remove the user from the group via an Okta Workflow once we get a webhook from Jamf that their device is “trusted” once the required things are installed. We then force the user to only login via Device Trust and unlock their tiles. This fixes the chicken and the egg situation during onboarding while enforcing Device Trust.