diff --git a/services/identity/src/database.rs b/services/identity/src/database.rs
--- a/services/identity/src/database.rs
+++ b/services/identity/src/database.rs
@@ -760,11 +760,22 @@
   pub async fn get_keys_for_user(
     &self,
     user_id: &str,
+    selected_devices: HashSet<&String>,
     get_one_time_keys: bool,
   ) -> Result<Option<Devices>, Error> {
     let mut devices_response = self.get_keys_for_user_devices(user_id).await?;
+
+    // Retain all devices if no filter is specified
+    if !selected_devices.is_empty() {
+      devices_response
+        .retain(|device_id, _| selected_devices.contains(device_id));
+    }
+
     if devices_response.is_empty() {
-      debug!("No devices found for user {}", user_id);
+      debug!(
+        "No devices matching given filter found for user {}",
+        user_id
+      );
       return Ok(None);
     }
 
diff --git a/services/identity/src/grpc_services/authenticated.rs b/services/identity/src/grpc_services/authenticated.rs
--- a/services/identity/src/grpc_services/authenticated.rs
+++ b/services/identity/src/grpc_services/authenticated.rs
@@ -217,10 +217,11 @@
   ) -> Result<tonic::Response<OutboundKeysForUserResponse>, tonic::Status> {
     let message = request.into_inner();
     let user_id = &message.user_id;
+    let selected_devices = message.selected_devices.iter().collect();
 
     let devices_map = self
       .db_client
-      .get_keys_for_user(user_id, true)
+      .get_keys_for_user(user_id, selected_devices, true)
       .await?
       .ok_or_else(|| {
         tonic::Status::not_found(tonic_status_messages::USER_NOT_FOUND)
@@ -243,10 +244,11 @@
   ) -> Result<tonic::Response<InboundKeysForUserResponse>, tonic::Status> {
     let message = request.into_inner();
     let user_id = &message.user_id;
+    let selected_devices = message.selected_devices.iter().collect();
 
     let devices_map = self
       .db_client
-      .get_keys_for_user(user_id, false)
+      .get_keys_for_user(user_id, selected_devices, false)
       .await
       .map_err(handle_db_error)?
       .ok_or_else(|| {