Does it work with Okta, Google Workspace or on-premise Active Directory?

Microsoft Entra ID, and nothing else today. Passbeam is built for it specifically rather than supporting it among others, which is why account status, group membership and Intune compliance all come from the same place and stay in step without anything being copied into Passbeam.

Okta, Google Workspace and LDAP are not supported, and Google Workspace was deliberately dropped before launch rather than half-built. On-premise Active Directory on its own is not either — but if it is synced to Entra ID, which most are, then it is Entra ID that Passbeam reads and the arrangement works exactly as normal.

A client does not have to have a directory at all. Printers, cameras, door controllers and other appliances get certificates from the same authority with nothing behind them — see “Can I use Passbeam for a network with no Entra ID at all — printers, cameras, door entry?”. What you cannot do is point Passbeam at a different directory and expect the account-status half to work.