Here is what Esri's site says about secured OGC Layers.
OGC WMS and WMTS services secured with web-tier authentication, such as Integrated Windows Authentication (IWA), a public key infrastructure (PKI), Basic, or Digest access authentication, are supported. OGC WMS and WMTS services secured with token-based authentication are not supported. Configure support for OGC services secured with web-tier authentication by adding the server hosting the services to your organization’s list of trusted servers. The server must support CORS; otherwise, layers hosted on the server will not function as expected in ArcGIS Online. If you will access the secure OGC service with Internet Explorer, you may need to add the domain of your organization’s trusted servers to your browser’s trusted sites list.
Once the server has been added to the list of trusted servers, you can add your OGC services to the map viewer or as an item (WMS only). If authentication is necessary, users adding or viewing secured OGC layers will be prompted to enter their credentials.
Link: OGC—ArcGIS Online Help | ArcGIS
Hope this helps!
Chris