Identity reconciliation
Okta governs access, but doesn't know whether that access changes after it's granted. Identity reconciliation continuously detects what actually exists in a downstream app compared to what Okta assigned, and surfaces those changes to admins with the context they need to act.
Early Access release. See Enable self-service features.
Benefits
- Proactive detection of unmanaged accounts and entitlement drifts
- Detecting permission changes for entitlements and accounts moves from reactive to proactive. Okta detects changes on import and provides stakeholders with information about what changed and the context they need to decide what action to take.
- Automatic rules-based revocation of entitlement drifts
- Identity reconciliation supports the detection of entitlement drifts in target apps and the ability to define rules for changes that aren't allowed, such as granting access to certain privileged entitlements.
- Non-disruptive rollout
- By default, identity reconciliation accepts and logs all differences. No automated access changes occur until an admin configures a revocation rule. Existing workflows remain intact, so your org can gradually adopt revocation rules without disrupting day-to-day operations.
How it works
Identity reconciliation detects governance access drift. Drift is the difference between the access that Okta expects a user to have and the actual permissions in a downstream app. Okta detects drift by comparing the information retrieved through app imports with the app user records in Okta.
Identity reconciliation detects two categories of drift: unmanaged accounts and entitlement drift.
- Unmanaged accounts: Accounts that exist in a downstream app that Okta didn't assign, wasn't aware of, or accounts whose status differs from the matching identity in Okta
- Entitlement drift: The difference between the access that a user currently has in a downstream app and the access that Okta assigned to the user
Drift can occur in several ways:
- Privilege creep: Users accumulate permissions as their roles and departments change, without previous access being revoked.
- Manual provisioning: Admins make direct, unmanaged changes or grant temporary exceptions that bypass regular approval workflows.
- Lifecycle latency: A delay occurs between when a user leaves the company or changes roles and their permissions being updated to reflect those changes.
- Deprovisioning failures: When a user leaves the company, the offboarding process fails to remove the account.
- Ecosystem complexity: Orgs rely on a large number of cloud services, SaaS tools, and non-human identities that lack consistent permission tracking.
Detection depends on imports
Detecting drift for an app requires that admins configure and maintain import schedules for that app at an appropriate cadence. This includes imports done manually, whether or not scheduled imports are configured. There's no change to existing import behavior. The initial import establishes a baseline that's used to compare against future imports to determine what drift occurred.
How identity reconciliation helps you remediate drift
Identity reconciliation detects entitlement drifts in target apps and enables you to define rules for changes that aren't allowed, such as granting access to certain privileged entitlements. Identity reconciliation provides you with the drift detected for an app with the context that you need to decide how to remediate the drift. Assigning app owners the responsibility to review and remediate drift lets them apply their domain knowledge, where other admins might lack the background to make the right call.
By default, identity reconciliation accepts and logs all differences. No automated access changes occur until an admin configures a revocation rule. Existing workflows remain intact, so your org can gradually adopt revocation rules without disrupting day-to-day operations.
What's not supported
- Okta doesn't auto-configure or enforce import schedules.
- Identity reconciliation isn't performed in real time and doesn't do event-based detection.