Could you use SSO as a layer for Device whitelisting?

Authenticate with SSO > IDP checks for Device fingerprint > IDP Approves Login if Device is whitelisted