Does it work with Okta, Google Workspace or on-premise Active Directory?

Microsoft Entra ID only. Account status, group membership and Intune compliance all come from Microsoft. Passbeam doesn't keep its own copy of your users or devices.

Okta, Google Workspace and LDAP aren't supported. On-premises Active Directory on its own isn't either. If it's synced to Entra ID, as most are, Passbeam reads Entra ID and everything works as normal.

A client doesn't have to have a directory. Printers, cameras, door controllers and other appliances can get certificates from the same authority with nothing behind them. See “Can I use Passbeam for a network with no Entra ID at all, such as printers, cameras, door access or building controls?”. The account status features need Entra ID.