Standard administrator roles and permissions

Org-wide settings

Permission	Super Admin	Org Admin	App Admin	Read-only Admin	Mobile Admin	Report Admin	API Access Management Admin	Access Certifications Admin
View and run reports	●	●		●	●	●
View Okta settings (themes, logo, contact info)	●	●		●	●
Grant access to Okta Support	●
Manage Profile Editor	●	●	●				●*
Manage profile mappings	●		●				●*
Manage sensitive attributes	●
Edit Okta settings	●	●
Add, remove, and view administrators	●
Add, delete, and edit authorization server scope, claim, and policies	●						●
View authorization server scope, claim, and policy	●	●		●			●
View System Log (system events)	●	●	●	●	●	●	●
Edit email and SMS template	●	●
Edit default email settings for other admins	●
View Device Trust enablement setting	●	●		●
Enable Device Trust setting	●	●
Close or retry tasks	●		●
Send custom notifications to users	●	●
Apply multibrand customization	●	●
Manage (enable, disable, update) CAPTCHA enablement settings	●	●
View CAPTCHA enablement settings	●	●		●
Manage log streaming	●
View Import Monitoring	●
Manage labels	●
View labels	●		●					●

* — Permissions apply only to OIDC apps.

User management

Permission	Super Admin	Org Admin	Group Admin	App Admin	Read-only Admin	Mobile Admin	Help Desk Admin	API Access Management Admin	Group Membership Admin	Access Requests Admin	Access Certifications Admin
View users	●	●	●*	●	●	●	●*	●	●	●	●
Create users	●	●	●*
Delete users	●	●	●*
Suspend users	●	●°	●*°
Deactivate users	●	●	●*
Activate users	●	●°	●*°
Change user types	●	●	●*
Sign out users	●	●	●*
Clear user sessions	●	●°	●*°				●*°
View logs	●	●°	●*		●°	●°
Edit profiles	●	●	●*	●^
Password resets, MFA resets	●	●	●*				●*
Choose not to receive email notifications about locked user accounts	●	●	●*	●		●		●
Reset user behavior profile	●	●°	●*				●*
View user behavior profile	●	●			●
View user types	●			●	●			●
Clear users' Chrome data	●	●°	●*°				●*°

* — Permissions apply only to groups that the admin is allowed to manage.

^ — Permissions apply only on user import for apps that don't have profile source configured.

° — Admin can perform the action on super admins.

Group management

Permission	Super Admin	Org Admin	Group Admin	App Admin	Read-only Admin	Mobile Admin	Help Desk Admin	API Access Management Admin	Group Membership Admin	Access Requests Admin	Access Certifications Admin
View groups	●	●	●*	●	●	●	●*	●	●	●	●
Add users to groups	●	●°	●^°						●*°
Add users to a group with assigned admin privileges	●
Remove users from groups	●	●°	●^°						●*°
Create groups	●	●
Manage group rules	●	●
View group rules	●	●	●	●	●	●	●	●	●
Assign admin privileges to a group	●
Delete groups	●	●
Edit group MFA factors	●	●				●

* — Permissions apply only to groups that the admin is allowed to manage.

^ — Permissions to create, add, and remove users apply only to groups that the group admin manages. Group admins can create new users in groups that they manage, remove users from groups that they manage, and move users between groups that they manage.

× — Permissions apply only if the admin has access to all users and groups.

° — The admin can perform the action on super admins.

Note:

Only super admins can manage groups with administrative roles. If a group admin is assigned access to a group that's later assigned an admin role, the group admin can no longer make any changes to the group or group members.
For orgs that have the group profile feature enabled, group membership admins can't modify group names or descriptions.

Service accounts management

Permission	Super Admin	Org Admin	Group Admin	App Admin	Read-only Admin	Mobile Admin	Help Desk Admin	Report Admin	API Access Management Admin	Group Membership Admin	Access Requests Admin	Access Certifications Admin
Create, edit, or remove service accounts	●
View service accounts

Application management

Permission	Super Admin	App Admin	Read-only Admin	Mobile Admin	API Access Management Admin	Access Requests Admin	Access Certifications Admin
View applications or application instances	●	●^	●	●	●*	●	●
Add and configure applications	●	●^			●*
Assign user access to applications	●	●^			●*
Create users in staged status through app import	●	●^
Configure AI agent imports for an app integration	●
Create, update, and delete client authorization settings for an AI agent provider app	●

* — Permissions apply only to OIDC apps.

^ — Permissions apply only to apps that the app admin is allowed to manage.

Mobile policies

Permission	Super Admin	Org Admin	Read-only Admin	Mobile Admin
View and manage devices	●	●		●
Configure Okta mobile manager	●	●		●
View policies (Mobile)	●	●	●	●
Setting APNS	●	●		●
Add/update/delete policies	●	●		●
Add/update/delete rules	●	●		●
Drag and drop policies for prioritization	●	●		●

Mobile devices

Permission	Super Admin	Org Admin	Read-only Admin	Mobile Admin
View Mobile tab on users section	●	●	●	●
View device details	●	●	●	●
Deprovision/clear PC/remote lock/reset	●	●		●
Deprovision/reset from Mobile tab	●	●		●

Hooks

Permission	Super Admin	Org Admin	Group Admin	App Admin	Read-only Admin	Mobile Admin	Help Desk Admin	Report Admin	API Access Management Admin	Group Membership Admin	Access Requests Admin	Access Certifications Admin
View hooks	●				●
Create and configure hooks	●

Policies

Permission	Super Admin	Org Admin	App Admin	Read-only Admin	Mobile Admin
View Okta Sign-On policies	●	●		●	●
Add/update/delete policies	●	●	●*		●
Add/update/delete rules	●	●	●*		●
Drag and drop policies for prioritization	●	●			●
Edit MFA factors in policies	●	●			●

* — Permissions apply only to app sign-on policies.

Org security

Permission	Super Admin	Org Admin	Read-only Admin	Mobile Admin
View network zones	●	●	●	●
Manage network zones	●	●
View org behavior profile	●	●	●
Manage org behavior profile	●	●
View ThreatInsight configuration	●	●	●
Manage ThreatInsight configuration	●	●

Multifactor Authentication

Permission	Super Admin	Org Admin	App Admin	Read-only Admin	Mobile Admin
Configure MFA factors	●	●
Enable MFA for the Admin Dashboard	●
Authorize RADIUS Agent	●		●	●	●

API tokens

Permission	Super Admin	Org Admin	Group Admin	App Admin	Read-only Admin	Mobile Admin	Help Desk Admin	Group Membership Admin
Create user tokens	●*	●*	●*		●*			●*
View user tokens	●	●	●^		●*	●		●*
Clear user tokens	●	●*	●*		●*		●^	●*
View user social tokens	●	●	●	●
Manage tokens	●	●	●		●*			●*

* — Admins can only perform the action on themselves.

^ — Permissions apply only to self and scoped members.

OpenID Connect end-to-end scenario

Permission	Super Admin	Org Admin	App Admin	Read-only Admin	API Access Management Admin
Create and modify an OIDC App, including registering an OAuth client. Can be restricted to OIDC client apps.	●		●		●
Add a social IDP	●	●
Read-only access to OAuth clients through the API	●	●	●	●	●

OMM applications

Permission	Super Admin	App Admin	Read-only Admin	Mobile Admin
View Mobile tab on apps	●	●	●	●
Edit and save EAS settings	●			●
Edit native Mobile Access checkboxes	●			●

OMM - Wifi (EA)

Permission	Super Admin	Org Admin	Read-only Admin	Mobile Admin
View wifi policies	●	●	●	●
Add/update/delete policies	●	●		●
Add/update/delete rules	●	●		●
Drag and drop policies for prioritization	●	●		●

Identity Governance

Access certifications admin and access requests admin roles are available only if you're subscribed to Okta Identity Governance.

Permission	Super Admin	Org Admin	App Admin	Access Requests Admin	Access Certifications Admin
View all campaigns	●				●
Create campaigns	●				●
Edit/launch scheduled campaigns	●				●
End active campaigns	●				●
Manage user access applications within Access Requests	●			●
Act as an administrator within Access Requests	●			●
Manage group ownership	●	●	●*

* — App admins can only assign or remove group owners. They can't manage group membership by adding or removing users from the group.

Workflows

The Okta super admin and the Workflows Administrator role have full administration and management privileges within the Okta Workflows product.

Note:

The Workflows Administrator role has no permissions to perform any actions in the Okta Admin Console.

A user or group assigned to the Workflows Administrator role can't grant the Workflows Administrator role to other users or groups in the Okta org. Only an Okta super admin can assign that role through the Okta Admin Console.

All Okta Workflows roles are assigned to users and groups using the Workflows Console, except for the Workflows Administrator role. See Manage Workflow roles.

Note:

For a complete summary of the permissions for this role, see Resource permissions.