Skip to main content
Skip to docs navigation
Docs
English (United States)
日本語 (日本)
Français (France)
Documentation
Identity Engine
Classic Engine
Access Gateway
Advanced Server Access
Aerial
Identity Security Posture Management
Workflows
Release Notes
Identity Engine
Classic Engine
Access Gateway
Advanced Server Access
Aerial
Identity Security Posture Management
Workflows
Okta Developer
Auth0
Auth0 Docs
Auth0 FGA Docs
Training
Support
English (United States)
日本語 (日本)
Français (France)
Feedback
Classic Engine publication
Okta Documentation
Okta Classic Engine
Release notes
Production
Preview
Early Access
Okta Mobile
Android
iOS
Okta Verify release notes
Okta Verify for Android
Okta Verify for iOS
Identity Governance
Okta Privileged Access
Device tools
Platform
Archive
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
Monitoring and reports
Administrator Dashboard
View your org at a glance
View your org agents' status
View Okta service status
Monitor your tasks
Monitor your org's security
Monitor your SSO apps
Admin Console search
Reports
Entitlements and access
Group membership
User accounts
User app access
Application usage
Okta password health
SAML capable apps
Application access
MFA activity
MFA usage
MFA enrollment by user
Suspicious activity
Deprovision details
Rate limits
Admin role assignments
Telephony usage
Deprecated reports
Current Assignments report
Recent Unassignments report
App Password Health report
Run reports
Receive reports by email
System Log
System Log filters and search
Common System Log filters
Log streaming
Add an AWS EventBridge log stream
Add a Splunk Cloud log stream
Edit the status of your log stream
Directory integrations
Active Directory integration
Get started with Active Directory integration
Typical workflow for integrating Active Directory
Active Directory integration prerequisites
Active Directory integration considerations and limits
Okta service account permissions
Supported Active Directory integration features
Active Directory integration implementation options
Plan for high availability and disaster recovery
Integration with existing Active Directory forests and domains
Prepare Active Directory for the integration
Import considerations
Supported attribute syntaxes
Manage your Active Directory integration
Install the Okta Active Directory agent
Configure Active Directory import and account settings
Configure Active Directory provisioning settings
Install multiple Okta Active Directory agents
Update the Okta Active Directory agent
Uninstall Okta Active Directory agent
Locate the Okta AD Agent log
Change the Okta Active Directory agent user
Change the number of Okta Active Directory agent threads
Okta Active Directory agent variable definitions
Configure DMZ server ports for Active Directory integrations
Register multiple domains to an Okta Active Directory agent
Make Active Directory the Profile Source
Rename an Active Directory domain
Delegated authentication with Active Directory
Enable delegated authentication for Active Directory
Check AD DirSync readiness
Enable imports with DirSync
Manage Active Directory users and groups
Import Active Directory users on demand
Schedule Active Directory user imports
Add and update users with Active Directory Just-In-Time provisioning
Make names optional in Active Directory
Confirm imported Active Directory user assignments
Import groups from Active Directory
Push groups from Okta to Active Directory
Enable universal security group support
Configure enhanced group push for Active Directory organizational units
Enable Okta-sourced user Organizational Unit updates
View users and groups associated with an Active Directory instance
Remove a group from Active Directory provisioning
Exclude AD username updates during provisioning
Disconnect users from Active Directory
Bidirectional Group Management with Active Directory
Access governance for AD groups
Work with Active Directory attributes
Base Active Directory attributes
Active Directory attribute mappings to Okta properties
Exclude Active Directory username updates during provisioning
Active Directory Desktop Single Sign-on
Desktop Single Sign-on prerequisites
Active Directory Desktop Single Sign-On known issues
About Active Directory Desktop Single Sign-on and Just-In-Time provisioning
Identify your Desktop Single Sign-On type
Configure agentless Desktop Single Sign-on
About the agentless Desktop Single Sign-on workflow
About agentless Desktop Single Sign-on failover
Create a service account and configure a Service Principal Name
Configure browsers for Windows agentless Desktop Single Sign-on
Configure browsers for Mac agentless Desktop Single Sign-on
Enable agentless Desktop Single Sign-on
Update the default Desktop Single Sign-on Identity Provider routing rule
Validate the agentless Desktop Single Sign-on configuration
Test the agentless Desktop Single Sign-on configuration
Migrate your agentless Desktop Single Sign-on configuration
Set the service principal name
Configure browsers for single sign-on on Windows
Test the Desktop Single Sign-on settings
Install and configure the Okta IWA Web agent for Desktop Single Sign-on
Migrate from Integrated Windows Authentication to agentless Desktop Single Sign-on
Learn about the Okta IWA Web agent
Okta IWA Web agent installation prerequisites
Install the Okta IWA Web agent
Configure Windows browsers for SSO
Configure Mac browsers for SSO
Activate the Okta IWA Web agent
Configure SSL for the Okta IWA Web agent
Configure routing rules for the Okta IWA Web agent
Test the Okta IWA Web agent
Test Okta IWA Web agent Desktop Single Sign-on
View the Okta IWA Web agent status
Customize the Active Directory DSSO sign-out page
Configure failover for the Okta IWA Web agent
Configure the Okta IWA Web agent Universal Principal Name
Change the Okta IWA Web agent timeout period
Disable Okta IWA Web agent authentication for specific clients
Install the Okta IWA Web agent on a virtual machine
Desktop Single Sign-on FAQ
Desktop Single Sign-on troubleshooting
Manage passwords
Synchronize passwords
Password synchronization use cases
Synchronize passwords from Okta to Active Directory
Synchronize passwords from Active Directory to Okta
Application password synchronization
Use Okta API to expire user passwords
Troubleshoot password synchronization
Automatically update Okta Active Directory agents
View Okta Active Directory (AD) agent status information
Auto-update a single agent on demand
Auto-update multiple agents on demand
Retry an on-demand agent auto-update
Cancel an on-demand agent auto-update
Schedule agent auto-updates
Turn an agent auto-update schedule on or off
Delete an agent auto-update schedule
Define the behavior for failed agent auto-updates
Unsubscribe from agent auto-update email notifications
Download the latest agent version
Active Directory integration FAQ
LDAP integration
Get started with LDAP integration
LDAP integration prerequisites
LDAP integration known issues
LDAP integration limits
LDAP integration features
Supported LDAP directories
LDAP incremental import support
Manage your LDAP integration
Install the Okta LDAP Agent
Configure LDAP integration settings
Configure Okta to LDAP provisioning settings
Configure LDAP to Okta provisioning settings
Modify LDAP integration settings
Enable LDAP over SSL
Map Okta user profile attributes to LDAP attributes
Verify the Okta LDAP agent download
Configure incremental imports for AD LDS
Reconfigure an Okta LDAP Agent
LDAP configuration parameters
Change the number of Okta LDAP agent threads
Add or remove custom LDAP attributes
Locate the Okta LDAP agent log
Manage the Okta LDAP Agent
Uninstall or reinstall the Okta LDAP Agent
Configure supported LDAP directory services
AD LDS LDAP integration reference
eDirectory LDAP integration reference
IBM LDAP integration reference
OpenDJ LDAP integration reference
Oracle Internet Directory LDAP integration reference
OpenLDAP integration reference
Oracle Directory Server Enterprise Edition LDAP integration reference
Oracle Unified Directory LDAP integration reference
Sun ONE Application Server LDAP integration reference
Set up and manage the LDAP Interface
LDAP Interface known limitations
LDAP Interface connection settings
Enable the LDAP interface
Expose app groups in the LDAP interface directory information tree
Use multifactor authentication with the LDAP Interface
LDAP interface pagination control
LDAP interface troubleshooting
Bidirectional Group Management with LDAP
Automatically update Okta LDAP agents
View LDAP agent status information
Auto-update a single agent on demand
Auto-update multiple agents on demand
Retry an on-demand agent auto-update
Cancel an on-demand agent auto-update
Schedule agent auto-updates
Turn an agent auto-update schedule on or off
Delete an agent auto-update schedule
Define the behavior for failed agent auto-updates
Unsubscribe from agent auto-update email notifications
Download the latest agent version
LDAP integration troubleshooting
CSV directory integration
Get started with CSV directory integration
CSV directory integration prerequisites
Typical workflow for integrating CSV directories
Manage your CSV directory integration
Download and install the Okta Provisioning agent
Configure the CSV directory integration settings
Configure the CSV directory integration profile attributes
Configure the CSV directory integration import settings
Test the CSV directory integration
User management
Manage users
Add users manually
Add and update users with Just-In-Time provisioning
Use Anything-as-a-Source
Import users
View the Import Monitoring dashboard
Import users from an app
Edit app provisioning settings
Clear unconfirmed users
Import users from a CSV file
Assign users to apps using a CSV file
Match imported user attributes
Import safeguards
Enable or disable import safeguards
Change threshold for import safeguard
Resolve import safeguard warnings on the Import Monitoring dashboard
Manage self-service registration settings
About self-service registration
Enable and configure a self-service registration policy
Disable the security image and security questions
Activate user accounts
Deactivate and delete user accounts
Edit deactivated user profiles
End Privileged Access
Assign applications to users
Search for application users
Unassign users from applications
Unlock an individual user account
Unlock multiple user accounts
Suspend and unsuspend users
Reset a user password
Reset multiple user passwords
Revoke all user sessions
Manage self-service password reset
Group password policies
Create a self-service password reset policy for your org
Add self-service password reset to an existing password policy
Configure voice call for self-service password resets
Configure SMS for self-service password resets
Enable Active Directory delegated authentication
Self-service password reset scenarios
Manage password expiry
Expire all user passwords
Expire a user's password on the Okta Admin Console
Expire a user password using the Okta API
Revoke a user's certificate from the Okta Certificate Authority
User account status
Manage groups
Groups
Okta group source types
Create a group
About group duplication in Microsoft Office 365
View group members
Manually assign people to a group
Bulk assign people to a group
Remove people from a group
Enable group import from provisioning-enabled apps
Review group imports
View and edit Okta group attributes
Remove groups imported from provisioning-enabled apps
Assign a single app to groups
Assign multiple apps to a group
Manage group prioritization
Prioritize application groups
Assign attribute group priority
Group prioritization use case
Manage group rules
Group rules
Group rules best practices
Manual group user management
Create group rules
Verify group membership changes
Edit group rules
Manage Group Push
Group Push
Group Push prerequisites
Enable Group Push
Group Push operations
App assignments and Group Push
Troubleshooting Group Push
Manage Group Linking
Configure Group Linking
Configure Group Linking to delete application groups
Manage profiles
Profile types
Attribute mappings
Expressions
About rich SAML assertions and WS-Federation claims
Work with profiles and attributes
View the Okta default user profile
View the Okta default group profile
Make the user profile first and last name optional
Create a custom character restriction for the Okta username
Add custom attributes to an Okta user profile
Add custom attributes to a default Okta group profile
Add custom attributes to apps, directories, and identity providers
Edit Okta default group profile custom attributes
Delete custom attributes from a user profile
Remove custom attributes from a default Okta group profile
Delete custom app, directory, and identity provider attributes
Enforce uniqueness of custom attributes
Enforce custom attribute uniqueness
Add or remove custom directory schema attributes
Review reserved attributes
Profile Push
View existing application attribute mapping
Map Okta attributes to app attributes in the Profile Editor
Map app attributes on the Provisioning page
Edit application attribute mapping
Modify attributes with expressions
Override a user name format
Override an app username
Override application attribute mapping
Remove mapping
Automatically update an app username
Work with Universal Directory user types
Custom user types in Universal Directory
Universal Directory custom user types known issues
Create a custom user type
Map a user type to an application
Create a user and assign a user type
Change the user type
Delete a user type
Manage profile and attribute sourcing
Profile sourcing
Designate profile sources for user attributes
Prioritize profile sources
Make an app the profile source
Define the attribute profile source
Map profile attributes
Edit user attributes
Allow users to edit attributes
Manage realms
Requirements and limitations
Get started with realms
Create realms
Delegate realm management
Manage realm users
Realm assignments
Realms with Okta Identity Governance
Use Workflows to manage realms
Manage service accounts
Alternative options to service accounts
Set up the Okta Privileged Access app
Manage a SaaS app service account
Manage an Okta user account as a service account
App integrations
Get started with app integrations
Learn about app integrations
Single Sign-On
OIDC app integrations
SAML app integrations
WS-Fed app integrations
SWA app integrations
SCIM app integrations
CASB configuration guide
Add app integrations
Add existing app integrations
Create custom app integrations
Create OpenID Connect app integrations
Manage secrets and keys for OIDC app client authentication
Encrypt OIDC ID tokens for app integrations
Create SAML app integrations
AIW SAML field reference
Define attribute statements
Define group attribute statements
Manage signing certificates
Configure custom claims for app integrations
Generate entitlement claims using the legacy configuration
Create SWA app integrations
Create SCIM app integrations with entitlement management
Add SCIM provisioning to app integrations
Configure Single Sign-On options
Configure settings for app integrations
Configure profile attributes for OIDC apps
Self Service for app integrations
Workflow to configure Self Service request feature
Enable self-service access to apps
Configure a Self Service approval workflow
Add app integrations as an end user
Handle app integration requests
Configure the Okta Template App and Okta Plugin Template App
Create a Bookmark App integration
Simulate an IdP-initiated flow with the Bookmark App
Configure Single Logout in app integrations
Configure Universal Logout
Mapping Active Directory, LDAP, and Workday Values in a SAML template
Integration guides
1Password Enterprise Password Manager
Integrate 1Password Enterprise Password Manager with Okta
Configure Okta SSO in 1Password Enterprise Password Manager
Manage user assignments and grace periods
Integrate 1Password Enterprise Password Manager with Okta for SSO Unlock
Verify SP-inititated SSO
Advent Black Diamond
Advent Black Diamond supported features
Configure Advent Black Diamond provisioning with Okta
Amazon Web Services Account Federation
Learn about Amazon Web Services integration
Connect Okta to a single Amazon Web Services instance
Configure Okta as the AWS account identity provider
Add Okta as a trusted source for AWS roles
Generate the AWS API access key
Configure the Amazon Web Services Account Federation app in Okta
Connect Okta to multiple Amazon Web Services instances
Integrate multiple AWS instances
AWS user and group access management
Configure AWS accounts and roles for SAML SSO
Create AWS role groups in an external directory
Create management groups to map users to AWS accounts and roles
Import AWS role and management groups into Okta
Enable group-based role mapping in Okta
Assign AWS management groups to the Okta AWS app
Artifactory
Artifactory supported features
Integrate Artifactory with Okta
Atlassian
Axway Amplify
Axway Amplify supported features
Integrate Axway Amplify with Okta
BambooHR
BambooHR supported features
BambooHR integration known issues
Integrate BambooHR with Okta
BMC Remedyforce
BMC Remedyforce supported features
Configure BMC Remedyforce provisioning with Okta
Box
Box supported features
Manage your Box integration
Integrate Box with Okta
Add attributes to a Box profile
Add existing Box groups to Okta
Assign Box to Okta groups and configure group push
Configure SAML group push for Box
Confluence On-Premises
Coupa
Coupa supported features
Integrate Coupa with Okta
CrowdStrike
CrowdStrike supported features
Integrate CrowdStrike with Okta
DocuSign
DocuSign supported features
Integrate DocuSign with Okta
Dropbox Business
Dropbox Business integration prerequisites
Dropbox Business integration known issues
Silently provision Dropbox Business
Dropbox Business supported features
Integrate Dropbox Business with Okta
FleetDM
FleetDM supported features
Configure FleeDM provisioning with Okta
Google Workspace
Troubleshooting
Manage Google Workspace users
Google email alias support
HashiCorp Cloud Platform
HashiCorp Cloud Platform supported features
Integrate HashiCorp Cloud with Okta
HashiCorp Vault
Integrate HashiCorp Vault with Okta
Configure the OIDC authentication method
Configure groups and policies
Test the integration
Informatica Cloud
Informatica Cloud supported features
Integrate Informatica Cloud with Okta
Jamf Pro Admin Console
Jamf Pro Admin Console supported features
Integrate Jamf Pro Admin Console with Okta
Jamf Pro User Enrollment
Jamf Pro User Enrollment supported features
Integrate Jamf Pro User Enrollment with Okta
JumpCloud
Integrate JumpCloud with Okta
Configure IdP for JumpCloud
Verify SP-initiated Single Sign-On (SSO)
Lucid
Lucid supported features
Integrate Lucid with Okta
Meta Work Accounts
Microsoft Entra ID and Office 365
Microsoft Entra ID Microsoft Entra ID
Integrate Microsoft Entra ID using SAML
About Microsoft Entra ID SAML integration
Create the Okta enterprise app in Microsoft Entra ID
Make Microsoft Entra ID an Identity Provider
Map Microsoft Entra ID attributes to Okta attributes
Test the Microsoft Entra ID integration
Integrate Hybrid Microsoft Entra ID Join
About Hybrid Microsoft Entra ID devices
Prerequisites for integrating Microsoft Entra ID join
Configure Office 365 sign-on rules to allow on-prem and cloud access
Configure Hybrid Join in Microsoft Entra ID
Hybrid Microsoft Entra ID integration FAQs
Microsoft Office 365
Deploy Office 365
Add Office 365 to Okta
Configure Single Sign-On for Office 365
Provision users to Office 365
Import users to Office 365 using Microsoft Graph API
Assign Office 365 to users and groups
Secure Office 365 using app sign-on policies
Office 365 sign on policies
About Office 365 sign on policies
Best security practices for Office 365 sign on policies
Office 365 sign-on rules options
Office 365 default sign-on rules
Create Office 365 sign-on rules
Office 365 provisioning and deprovisioning
Enable deprovisioning in Office 365
Add custom attributes
Map custom attributes
Skip importing groups during Office 365 user provisioning
Provisioning options for Office 365
Deprovisioning options for Office 365
Manage Office 365 licenses and roles
Supported user profile attributes for Office 365 provisioning
Supported user profile attributes for Office 365 import
Advanced integration topics for Office 365
Allow or deny custom clients in Office 365 sign-on policy
Provide Microsoft admin consent for Okta
Office 365 Silent Activation: New Implementations
Office 365 Silent Activation: Old Implementations
Migrate registry-key-based Office 365 Silent Activation to new configuration
Use Okta MFA for Microsoft Entra ID (formerly Azure Active Directory)
Federate multiple Office 365 domains in a single app instance
Okta support for hybrid Microsoft Entra ID joined devices
Get started with Office 365 provisioning and deprovisioning
Enable Microsoft Office 365 applications
Move Microsoft Office 365 from Secure Web Authentication to WS-Federation
Configure Office 365 GCC Tenant
Configure the Okta Template WS Federation Application
Configure WS-Federation for Office 365
Group linking for Microsoft Office 365
Office 365 FAQs
Microsoft SharePoint (On-Premises)
Typical deployment workflow for SharePoint (On-Premises)
Deployment Scenarios
Add SharePoint (On-Premises) in Okta
Configure Okta as a claims provider in SharePoint (On-Premises)
Configure Okta SharePoint People Picker agent
Deploy Okta People Picker for SharePoint agent
Uninstall Okta People Picker and Okta authentication
Troubleshooting: Microsoft SharePoint (On-Premises)
Microsoft SharePoint (On-Premises) FAQs
Mimecast Personal Portal V3
Mimecast Personal Portal V3 supported features
Integrate Mimecast Personal Portal V3 with Okta
MuleSoft Anypoint Platform
Create an OIDC integration
Integrate MuleSoft Anypoint Platform with Okta
Configure IdP for MuleSoft Anypoint Platform
Configure the Redirect URI in Okta
Test the integration
Create a SCIM integration
MuleSoft Anypoint Platform supported features
Integrate MuleSoft Anypoint Platform provisioning with Okta
Okta Org2Org
Okta Org2Org supported features
Integrate Okta Org2Org with Okta
Okta Identity Security Posture Management (ISPM)
OneLogin
Create an OneLogin OIDC integration
Integrate OneLogin with Okta
Configure Okta SSO in OneLogin
Configure Just-In-Time provisioning in OneLogin
Verify SP-initiated Single Sign-On (SSO)
Create an OneLogin SCIM integration
OneLogin supported features
Configure OneLogin provisioning with Okta
Oracle Human Capital Management
Oracle Human Capital Management supported features
Enable Oracle Human Capital Management provisioning
Oracle Identity Access Management
Oracle Identity Access Management supported features
Integrate Oracle Identity Access Management with Okta
PagerDuty
PagerDuty supported features
Integrate PagerDuty with Okta
Rally Software
Rally Software supported features
Integrate Rally Software with Okta
Add custom Rally Software attributes
RingCentral
RingCentral integration prerequisites
RingCentral supported features
Okta to RingCentral attribute mapping requirements
Manage your RingCentral integration
Integrate RingCentral with Okta
Enable RingCentral bidirectional attribute synchronization
Add custom RingCentral attributes
Troubleshoot RingCentral integrations
Salesforce
Salesforce supported features
Supported Salesforce custom attribute types
Manage your Salesforce integration
Enable Salesforce single sign-on
Enable Salesforce provisioning
Add attributes to a Salesforce profile
Configure OAuth and REST integration
Create a Salesforce Community integration
Create a Salesforce Portal integration
Create a Salesforce Government Cloud integration
SAP Analytics Cloud
SAP Analytics Cloud supported features
Integrate SAP Analytics Cloud with Okta
SAP Concur
SAP Concur supported features
Integrate SAP Concur with Okta
SAP SuccessFactors Employee Central
Learn about SAP SuccessFactors Employee Central integration
SAP SuccessFactors Employee Central integration prerequisites
SAP SuccessFactors Employee Central supported features
Learn about SAP SuccessFactors Employee Central data provisioning
Supported SAP SuccessFactors Employee Central entities and attributes
Manage your SAP SuccessFactors Employee Central integration
Integrate SAP SuccessFactors Employee Central with Okta
Set Time Zone Aware Pre-hires/Terminations
View the SAP SuccessFactors Employee Central Start Date attributes
SentinelOne
SentinelOne supported features
Enable SentinelOne provisioning
ServiceNow
ServiceNow (Eureka)
ServiceNow UD SSO migration guide
ServiceNow UD Provisioning migration guide
Slack
Slack integration prerequisites
Slack supported features
Supported Slack attributes
Integrate Slack with Okta
Troubleshoot Slack integrations
Splunk
Splunk Enterprise supported features
Enable Splunk Enterprise provisioning
Splunk Cloud
Splunk Cloud supported features
Configure Splunk Cloud provisioning with Okta
ThoughtSpot
Create ThoughtSpot OIDC integration
Integrate ThoughtSpot with Okta
Configure Okta IdP for ThoughtSpot
Verify SP-initiated Single Sign-On (SSO)
Create ThoughtSpot SCIM integration
ThoughtSpot supported features
Enable ThoughtSpot provisioning
Trend Micro
Trend Micro supported features
Integrate Trend Micro with Okta
Twilio
Twilio supported features
Integrate Twilio with Okta
UKG Pro
UKG Pro prerequisites and known issues
UKG Pro supported features
Create a UKG Pro report and report ID
Integrate UKG Pro with Okta
UltiPro template
Workato
Workato supported features
Integrate Workato with Okta
Workday
Workday incremental imports
Workday Real-Time Sync
Workday Email and Phone writeback
Configure Workday writeback for home and work contacts
Best practices and FAQ
Import with custom reports
Workplace by Facebook
Zendesk
Zendesk supported features
Zendesk considerations and limits
Integrate Zendesk with Okta
Zoho Mail
Zoho Mail supported features
Integrate Zoho Mail with Okta
Netskope Admin Console
Netskope Admin Console supported features
Integrate Netskope Admin Console with Okta
Access and customize app integrations
Assign app integrations
Manage app integration assignments
Manage Federation Broker Mode
Enable Federation Broker Mode
Disable Federation Broker Mode
Federation Broker Mode known limitations
Copy the embed link for an app integration
Redirect unauthenticated users to a custom login page
Redirect unassigned users to a custom error page
Convert app integrations from individually owned to group managed
Customize an app logo
Add notes to an app integration
Set up VPN notification
Reveal the password of an app integration
Pass Dynamic Authentication Context
Pass Device Context using Limited Access
Remove app integrations
Deactivate app integrations
Delete app integrations
Provision apps
Get started with provisioning
Provisioning
Lifecycle of a provisioned user
Add provisioned users
Workflow for deploying new provisioning app integrations
Workflow for adding provisioning to app integrations
On-premises provisioning
Workflow for deploying on-premises provisioning
Provision cloud applications
Search for an existing OIN app integration
Add an app integration to Okta
Create and configure a duplicate app instance
Configure provisioning for an app integration
Assign app integrations
Provision on-premises apps
On-premises provisioning and entitlements
Enable TLS 1.2
Install the Okta Provisioning Agent
Install the Okta On-prem SCIM Server agent
Agent configuration file
Okta On-prem Connector
Okta On-prem Connector guides
On-prem Connector for Oracle EBS
Supported attributes for Oracle EBS
On-prem Connector for SAP Netweaver ABAP
Configure admin roles for SAP Netweaver ABAP
Supported attributes for SAP Netweaver ABAP
On-premises Connector for Generic Databases
Supported entitlements by On-prem Connector
Install Okta On-prem Connector
Uninstall Okta On-prem Connector
SQL statements, stored procedures, and custom code
System requirements for On-prem Connectors - Oracle EBS and SAP Netweaver ABAP
System requirements for On-premises Connector - Generic Databases
Create an instance of your on-premises app in Okta
Create and test SCIM connectors
Create SCIM connectors for on-premises provisioning
Test SCIM connectors for on-premises provisioning
SCIM messages for on-premises provisioning
Connect to a SCIM connector
Configure the API call timeout period
Make an on-premises app the profile source
Okta Provisioning Agent incremental import
Upgrade Okta Provisioning Agent
Uninstall and reinstall the Okta Provisioning Agent
Manage provisioned users
Assign an app integration to a user
Provision users
Automatically update user attributes
Assign an app integration to a group
Convert an individual assignment to a group assignment
Automatically deactivate app users
Deprovision a user
Reactivate a user profile
Troubleshoot provisioning
Provisioning Integration Error Events
App integrations FAQ
API Service Integrations
Add an API Service Integration
Rotate a Client Secret for an API Service Integration
Revoke an API Service Integration
Devices
Device Trust
Managed Windows computers
MDM-managed Android devices
MDM-managed iOS devices
Integrate Okta with Workspace ONE for Android and iOS devices
Enforce Device Trust and SSO for mobile devices
Step 1: Configure Workspace ONE Access as an Identity Provider in Okta
Step 2: Configure Okta application source in Workspace ONE Access
Step 3: Configure Routing Rules, Device Trust, and Client Access Policies in Okta for iOS and Android Devices
Configure streamlined Device Enrollment and Workspace ONE login using Okta
Configure Okta as an Identity Provider for Workspace ONE Access
(Optional) Publish Okta apps to the Workspace ONE catalog
Integrate Okta with Workspace ONE for macOS and Windows devices
Enforce Device Trust and SSO for desktop devices
Step 1: Configure Workspace ONE Access as an Identity Provider in Okta
Step 2: Configure Okta application source in Workspace ONE Access
Step 3: Configure Device Trust and Access Policies in Workspace ONE for desktop devices
Configure streamlined Device Enrollment and Workspace ONE login for desktop devices using Okta
Configure Okta as an identity provider for Workspace ONE Access
(Optional) Publish Okta apps to the Workspace ONE catalog
TPM and Okta Device Trust for Windows devices
Okta Mobile
About Okta Mobile
Configure settings
Hide apps from Okta Mobile
Okta Mobile Safari Extension
Okta Android apps outside Google Play Store
Authentication
Enable delegated authentication for LDAP
Identity providers
Add a social login (IdP)
Add a SAML 2.0 IdP
Add a SAML Identity Provider
Add metadata for an Identity Provider
Configure Universal Directory mappings
Specify an error page for Identity Provider, SAML, or SSO
Customization options for inbound SAML
Add a Smart Card IdP
Format a PKI certificate chain
Add a Smart Card identity provider
Smart Card idpUser expressions
Expressions
Test the Smart Card or PIV card configuration
Troubleshooting Smart Card and PIV card authentication
Identity provider routing rules
Configure identity provider routing rules
Configure dynamic routing rules
Modify routing rules
Generic OpenID Connect
Add an Okta Integration identity provider
Multifactor Authentication
About MFA
MFA factor configuration
Okta Verify
Configure Okta Verify
Collected data types
Supported platforms
Custom IdP Factor
Custom TOTP factor (MFA)
Duo
Email
Google Authenticator
Security Question
SMS
Symantec VIP
Voice Call
FIDO2 (WebAuthn)
Passkeys (FIDO2 WebAuthn) support and behaviorFIDO2 (WebAuthn) support and behavior
YubiKey
MFA enrollment policies
Configure an MFA enrollment policy
App Condition
MFA Factor Sequencing
MFA for third-party agents
Okta On-Prem MFA agent (formerly RSA SecurID)
Add and configure On-Prem MFA/RSA SecurID
Disable SSL Pinning
Install the On-Prem MFA Agent
Configure high availability
Configure verbose logging
Uninstall and reinstall the agent
Okta MFA Credential Provider for Windows
Configure your Okta org for MFA Credential Provider for Windows
Assign users/groups to the Microsoft RDP (MFA) app
Install the Okta Credential Provider for Windows
Verify MFA for RDP sessions
Configure a system proxy account
Troubleshoot MFA issues for the MFA Credential Provider for Windows
Okta MFA provider for Active Directory Federation Services
Install and configure Microsoft ADFS in Okta
Install the Okta ADFS Plugin on your ADFS Server
Enable the Okta MFA Provider in ADFS
Add Access Control Policy to a Relying Party Application
Assign the Microsoft ADFS (MFA) application
Verify the Okta MFA prompt when signing in to ADFS
Enable OpenID Connect with existing Active Directory Federation Services apps
Enable MFA for Active Directory Federation Services (ADFS) as a service
Troubleshooting
Farm addendum
Uninstall the Okta ADFS Plugin on your ADFS Server
Configure MFA for Active Directory Federation Services (ADFS)
MFA for Electronic Prescribing for Controlled Substances - Hyperspace
MFA for Electronic Prescribing for Controlled Substances (EPCS) - Flow
Install and configure Epic Hyperspace in Okta
Install the Okta Hyperspace Agent
Configure a device in Chronicles
Configure Hyperspace
Test the user sign-in process
Troubleshoot the Hyperspace integration
MFA for Electronic Prescribing for Controlled Substances - Hyperdrive
MFA for Electronic Prescribing for Controlled Substances - Flow
Install and configure Epic Hyperdrive in Okta
Install the Okta Hyperdrive Agent
Configure Hyperdrive to integrate with Okta
Configure a Chronicles device
Test the user sign-in process
Troubleshoot the Hyperdrive integration
MFA for Oracle Access Manager
Configure MFA Factor MFA Authenticator enrollment in Okta
Install and configure the Oracle Access Manager plugin
Deploy OktaWidget.war
Manually activate the Okta OAM plugin
Configure Module, Scheme and Policy
Enable SSL on OAM servers
Reset MFA for end users
Sign-on policies
App sign-on policies
Okta sign-on policies
Password policies
Configure an app sign-on policy
Configure an Okta sign-on policy
Configure a password policy
RADIUS Integrations
Getting Started with RADIUS Integrations
About the Okta RADIUS Agent
Install and configure the RADIUS Agent
About creating Okta applications that use the RADIUS agent
Install Okta RADIUS server agent on Windows
Install the Okta RADIUS Server Agent for Windows
Configure properties
Access and manage log files
Troubleshoot the Windows RADIUS agent
Uninstall the Windows RADIUS agent
Install Okta RADIUS server agent on Linux
Install the RADIUS Linux server agent
Configure proxies
Configure properties
Manage the agent
Troubleshoot the Linux RADIUS agent
Access and manage log files
Uninstall the agent
Determine the RADIUS agent version
RADIUS Integrations
Amazon WorkSpaces
Prepare Amazon WS
Install and configure the RADIUS agent in AWS
Configure AWS inbound rules
Add the Amazon WorkSpaces app
Amazon Workspaces with MFA User Experience
Configure Amazon Workspaces MFA
Provision users
BeyondTrust
Add the BeyondTrust MFA (RADIUS) app
BeyondTrust optional settings
Configure the BeyondInsight gateway
Testing the BeyondInsight integration
Troubleshoot the BeyondInsight integration
Check Point
Check Point RADIUS integration flow
Add the Check Point Software (RADIUS) app
Configure the Check Point SmartConsole
Configure Check Point optional settings
Test the Check Point RADIUS integration
Troubleshoot the Check Point integration
Cisco Meraki
Cisco Meraki RADIUS integration flow
Add the Cisco Meraki Wireless LAN (RADIUS) app
Cisco Meraki optional settings
Configure Cisco Meraki to use the Okta RADIUS Agent
Configure wireless clients for Cisco Meraki
Troubleshoot Cisco Meraki integrations
Cisco ASA IKEv2 VPN
Add the Cisco ASA IKEv2 RADIUS app
Configure the Cisco ASA VPN to interoperate with RADIUS
Configure optional settings
Configure the Windows VPN
Configure trusted root CA
Test the Cisco ASA integration
Cisco ASA VPN
Add the Cisco ASA VPN (RADIUS) app
Configure the Cisco ASA gateway
Configure optional settings
Test the Cisco RADIUS ASA VPN integration
Cisco FMC
Add the Cisco VPN for Firewall Management Center RADIUS app
Configure Cisco Firewall Management Center
Test the Cisco Firepower Management Center integration
Citrix Netscaler
Citrix Gateway supported versions, clients, features, and factors
Add the Citrix Gateway (RADIUS) app
Configure the Citrix Gateway
Configure optional settings
Citrix Gateway end user experience
F5 BigIP APM
Add the F5 BIG IP RADIUS app
Configure F5 BIG IP APM gateway
Configure F5 BIG IP optional settings
Test the F5 BIG IP integration
Fortinet Appliance
Add the Fortinet Fortigate (RADIUS) app
Configure the Fortinet gateway
Configure optional settings
Test the Fortinet appliance integration
Troubleshoot the Fortinet Application integration
NetMotion Mobility
Add the NetMotion Mobility (RADIUS) app
Netmotion Mobility - Add trusted root certificate
Configure NetMotion Mobility to work with RADIUS
NetMotion Mobility user experience
Palo Alto Networks VPN
Palo Alto Networks supported features and factors
Add the Palo Alto Networks VPN (RADIUS) app
Configure Palo Alto Networks VPN to use the Okta RADIUS
Configure optional settings
Test the Palo Alto Networks VPN integration
Troubleshoot the Palo Alto Network VPN integration
Pulse Connect Secure
Pulse Connect Secure supported versions, and factors
Add the Pulse Connect Secure (RADIUS) app
Configure the Pulse Connect Secure gateway
Pulse Secure optional settings
Test the Pulse Connect Secure integration
Sophos UTM
Add the Sophos UTM (RADIUS) app
Configure the Sophos USM gateway
Sophos UTM optional settings
Test the Sophos UTM integration
VMWare Horizon View
Add the VMware Horizon View (RADIUS) app
Configure the VMware Horizon View Connection Server
VMware Horizon View optional settings
Test the VMware Horizon integration
Autopush for RADIUS
RADIUS applications in Okta
Add the RADIUS app
Configure the RADIUS customer application
Test the generic RADIUS integration
Client IP reporting
Okta group membership information for authorization
RADIUS service address filtering
RADIUS server best practices
About certificates
About the Okta RADIUS server agent
Okta RADIUS Server Agent flow
RADIUS deployment architectures
RADIUS session persistence best practices
RADIUS throughput and scaling benchmarks
RADIUS common issues and concerns
RADIUS server logging
RADIUS network zones
SAML integration advantages
Org-level security
Administrator roles
Learn about administrators
Custom admin roles
Super administrators
Organization administrators
Application administrators
Group administrators
Group membership administrators
Help desk administrators
Report administrators
Mobile administrators
Read-only administrators
API Access Management administrators
Access requests administrators
Access certifications administrators
Workflows Administrator
Set up administrators
Use custom admin roles
Role permissions
Permission conditions
Work with the resource set component
Create a resource set
Edit a resource set
Resource set conditions
Create an admin assignment using a resource set
Work with the role component
Create a role
Edit a role
Create an admin assignment using a role
Use standard roles
Standard administrator roles and permissions
Edit resources for a standard role assignment
Work with the admin component
Create an admin role assignment using an admin
Configure help desk administrators
Configure third-party administrators
Remove an admin role assignment
Configure email notifications for an admin role
Configure administrator settings
Enable MFA for the Admin Console
Administrator resources
Administrators page
Best practices for group admin role assignments
Best practices for creating a custom role assignment
Guidance for structuring Okta groups
Get started with Okta
Govern Okta admin roles
Get started
Configure policies for Govern Okta admin roles apps
Access Requests for admin roles
Create an admin role bundle
Manage admin role bundles
Create an access request condition
Manage access request conditions
Manage an approval sequence
Request admin role assignment
Manage admin role access requests
Access Certifications for admin roles
Create campaigns to review admin roles
Manage campaigns
Review access to admin roles
Breached credentials protection
Configure breached credentials protection
Test your breached credentials protection configuration
User experience with breached credentials protection
Configure Admin Console session
General Security
Protected actions in the Admin Console
HealthInsight
About HealthInsight
HealthInsight tasks and recommendations
Limit the number of super admins
Disable weaker MFA factors in factor enrollment policies
Enforce a limited session lifetime for all policies
Suspicious Activity Reporting
Sign-on notifications for end users
Factor enrollment notifications for end users
Factor reset notifications for end users
Password changed notification for end users
Enable SAML or OIDC authentication for supported apps
Change the authentication frequency
Evaluate a risk score for each request
Blocklist network zones
Enable strong password settings for password policies
MFA for the Admin Console
Set required factors for MFA enrollment policies
Blocklist proxies with high sign-in failure rates
Network zones
Network zone types
IP zones
IP exempt zone
Dynamic zones
Enhanced dynamic zones
Supported IP service categories
Manage network zones
Create an IP zone
Create a dynamic zone
Create an enhanced dynamic zone
Edit or delete a network zone
Add IPs to a network zone from the System Log
Use network zones in your org
Generate a Proxy IP report
Add a network zone to policies
Create a network zone for IWA
Troubleshoot network zone issues using System Log
Use network zones with VPN notifications
Use zones in routing rules
Unblock false positives in System Log
Network zones FAQ
Recent Activity
Risk scoring
Behavior Detection and evaluation
About Behavior Detection
Improved New Device Behavior Detection
About behavior types
Behavior Detection System Log events
Configure Behavior Detection
Add a location behavior
Add IP behavior
Add device behavior
Add a velocity behavior
Add an ASN behavior
Manage behavior settings
Reset the user behavior profile
Add a behavior to a sign-on policy rule
Risk Scoring and Behavior Detection
Behavior Detection and risk evaluation FAQ
ThreatInsight
About Okta ThreatInsight
Configure Okta ThreatInsight
Exclude IP zones from Okta ThreatInsight evaluation
System Log events for Okta ThreatInsight
HealthInsight reporting on Okta ThreatInsight
Telephony
Choose telephony provider
Regulatory compliance
Prevent or mitigate telephony-based fraud
Configure and use telephony
Configure a telephony provider through an inline hook
Configure Workflows for Telephony
API access management
Build authorization servers
Create an authorization server
Create API access scopes
Create API access claims
Create access policies
Test your authorization server configuration
Add trusted servers
Rotate signing keys
Encrypt access tokens for authorization servers
Delete an authorization server
Manage Okta API tokens
Configure Trusted Origins
Trusted Origins for iFrame embedding
Allow access to Okta IP addresses
Mitigate the impact of third-party cookie deprecation
Identity Governance
Overview
Access Certifications
Campaigns
Get started
Customizable reviewer context
Governance analyzer
Configure Governance Analyzer settings
Best practices for creating campaigns
Create preconfigured campaigns
Discover inactive users campaign limits
Create resource campaigns
Create user campaigns
Recurring campaign considerations
Examples of Okta Expression Language
Understand Disable self-review
Understand remediation
Assignment methods
View the progress of an active campaign
View previously completed campaigns
Copy campaigns
Modify a scheduled campaign
Modify campaign's end date
Certification campaign reviews
Review campaigns
Reassign review items
Security access reviews
Get started
Launch a security access review
Understand remediation
Understand prioritization
Manage Security Access Reviews
Review access
Access Requests
Get started
Conditions
Configure policies for Access requests apps
Configure settings
Create a condition
Create an access request condition for a resource collection
Manage access request conditions
Configure an approval sequence
Request types
Configure your Okta org for request types
Create a team
Modify a list
Create a request type
Configure a request type associated with bundles
Request type settings
Create a sample Request Type
Create requests
End-User Dashboard
Access Requests web app
Slack
Microsoft Teams
Manage tasks
Escalate tasks
Manage requests
Export data
Notifications
Entitlement Management
Get started
Considerations and limits
Provisioning-enabled apps
Apps with entitlement support
Configure a provisioning-enabled app
Provisioning-enabled app limits
Coupa requirements
GitHub Team requirements
Google Workspace requirements
NetSuite requirements
Salesforce requirements
Workday requirements
Enable Entitlement management
Create campaigns to audit entitlements
Entitlements
Create
Manage
Sync entitlements from provisioning-enabled apps
Revoke entitlements in downstream apps
Entitlement policy
Create policy
Examples of Okta Expression Language
Preview policy
Apply policy
Manage policy
Entitlement bundles
Create
Manage
Resource collections
Get started with resource collections
Create a resource collection
Manage resource collections
Manage resource collection assignments
Manage resource collection apps
Separation of duties
Get started with separation of duties
Create separation of duties rules
Manage separation of duties rules
Understand separation of duties conflicts
User and resource management
Resource owners
Assign resource owners
Change resource owners
Remove resource owners
Resource labels
Group ownership
Configure Okta group owners
Import from Active Directory
Update group profile attributes
Add custom attributes to the default group profile
Assign entitlements to users
Import user entitlements from CSV
Manage user entitlements
View user entitlements
Governance delegates
Assign delegate from the Admin Console
Manage delegates
Governance tasks for delegates
Settings
Enable end users to assign delegates
Integrations
Considerations and best practices for integrating Slack and Microsoft Teams
Integrate Slack
Configure settings for Slack
Integrate Microsoft Teams
Integrate Jira
Integrate ServiceNow
Enable AI
Allow requesters to escalate tasks
Reports
Active Campaign Summary
Column reference
Active Campaign Details
Column reference
Past Campaign Details
Column reference
Past Campaign Summary
Column reference
Auditor reporting package
Generate the auditor reporting package
Past Access Requests report
Past Access Requests (Conditions) report
Separation of duties report
User Entitlements report
Okta Privileged Access
Requirements and limitations
Get started with Okta Privileged Access
Set up Okta Privileged Access
Configure group sync
Users and Groups administration
Groups
Service users
Resource administration
Resource groups
Resource assignment
Manage service accounts
Certify service accounts
Manage Active Directory accounts
Requirements and limitations
Get started with Active Directory accounts
Grant Okta Active Directory (AD) agent password management permissions
Set up Active Directory domains
Active Directory account rules
Set up Active Directory account rules
Manual account assignment
Windows domain controller
Manage database accounts
Database integration prerequisites
Set up database integration
Configure gateway for database integration
Add new database integration
Permissions for database access
Projects
Servers
Secrets
Secret folders
Okta service accounts
SaaS app service accounts
Active Directory accounts
Database accounts
Sudo command bundle
Create a sudo command bundle
System Configuration
Security administration
Security policy
Add rules to a policy
Rule conditions
Okta Privileged Access with Access Requests
Multifactor authentication
Privileged elevation
Checkout
Enable checkout
Force a checkin
Workloads
Requirements and limitations
Get started
Configure workload connection
CLI command for workload authentication
Configure workload roles
Principal SSH access for automated workloads
User guide
Deploy and manage servers
Install the Okta Privileged Access server agent
Install the Okta Privileged Access server agent on Red Hat (RHEL), Amazon Linux, or Alma Linux
Install the Okta Privileged Access server agent on SUSE Linux
Install the Okta Privileged Access server agent on Ubuntu or Debian
Install the Okta Privileged Access server agent on Windows
Server Enrollment
Create a server enrollment token
Verify server enrollment
Unenroll a server from Okta Privileged Access
Managed Okta Privileged Access server agent
Customize SSHD configurations for servers
Configure agent lifecycle management hooks for Okta Privileged Access
Configure the Okta Privileged Access server agent
Okta Privileged Access clients
Install the Okta Privileged Access client
Install the Okta Privileged Access client on macOS
Install the Okta Privileged Access client on Red Hat (RHEL), Amazon Linux, or Alma Linux
Install the Okta Privileged Access client on SUSE Linux
Install the Okta Privileged Access client on Ubuntu or Debian
Install the Okta Privileged Access client on Windows
Enroll the Okta Privileged Access client
Silently enroll the Okta Privileged Access client
Use the Okta Privileged Access client
SFT keyring
URL handler
SSH setup
Customize SSH configurations for clients
RDP setup
Configure clients for use with Okta Privileged Access
Configure Cygwin for Okta Privileged Access
Use PuTTY for Okta Privileged Access
Configure Royal TSX for Okta Privileged Access
Use WinSCP for Okta Privileged Access
Gateways
Install the Okta Privileged Access gateway
Install the Okta Privileged Access gateway on Red Hat (RHEL), or Amazon Linux
Install the Okta Privileged Access gateway on Ubuntu or Debian
Create setup tokens
Configure the Okta Privileged Access gateway
Manage the Okta Privileged Access gateway
Session recording
Enable session recording on a project
Install the RDP Session transcoder
Manage session logs
Okta Privileged Access gateway capacity planning
Okta Privileged Access gateway high availability
Audit Events Integration with Okta System Log
Kubernetes access management
Configure Kubernetes access management
Kubernetes cluster connections
Reference
Roles and permissions
Okta Privileged Access accounts
Components
User attributes
Configure team-level user attributes
Import user attributes using custom mappings
Attribute conflicts
Okta Privileged Access port requirements
Security policy concepts
Server name resolution
Secret permissions
User management
User management in Linux
User management in Windows
Windows Internals
Supported SaaS apps
Supported operating systems
Get support
Automations and hooks
Automations
Add an automation
Inline hooks
Add an inline hook
Preview an inline hook
View usage metrics for your inline hooks
Delete an inline hook
Manage keys
Event hooks
Create an event hook
Edit an event hook filter
Okta Expression Language
Verify an event hook
Preview an event hook
Delegated flows
Run a delegated flow
User experience
Account settings
Set up contacts
Give access to Okta Support
Enable the Directories Debugger
Configure client-based rate limiting
Set up rate limit notifications
Configure your email notifications
Branding
Set a theme for your org
Customize your sign-in page
Understand Sign-In Widget color customization
Customize an error page
Apply your theme to Okta email notifications
Customize the footer for your org
Configure a custom domain
Disable the Okta loading page
Org display language
Customization settings
Customize personal information and password management
Configure optional user account fields
Customize a sign-out page
Configure a custom application error page
Customize the Content Security Policy (CSP) for a custom domain
Configure the Okta Browser Plugin settings
Manage dashboard tabs for end users
Configure reauthorization frequency for the Okta Admin Console
App settings for end users
Downloads
Email and SMS
Customize an email template
Test a customized email template
Customize an SMS message
Configure a custom email address
Velocity Template Language
Features
Okta Personal for Workforce
Configure interface updates
Configure app migration to Okta Personal
Okta Personal for Workforce user experience
Okta End-User Dashboard
End-user experience
Create sign-on policies with Okta Applications
Control access to the Okta End-User Dashboard
Recently used apps
Disable Okta communications to end users
Okta Browser Plugin
Security features
Allow users to add apps
Control access to the Okta Browser Plugin
Configure custom end-user portals
Prevent browsers from saving credentials
Okta Browser Plugin permissions for web extensions
Manage installation and upgrade
Make apps detectable to the Okta Browser Plugin
Silent installations
Chrome
Firefox
Internet Explorer
Supported browsers
End of support for TLS 1.1
Okta first-party App Switcher
References and specifications
Supported operating systems and browsers
Object IDs
Supported Okta email address characters
Supported display languages
Okta agent support policies
Okta disaster recovery
Initiate failover and failback for your org
Downloads and version histories
Okta Active Directory agent version history
Okta Active Directory Password Sync agent version history
Okta ADFS Plugin version history
Okta Browser Plugin version history
Okta Confluence Authenticator version history
Okta Device Trust for macOS Registration Task Version History
Okta Device Trust for Windows Desktop Registration Task Version History
Okta Hyperdrive agent version history
Okta Hyperspace agent version history
Okta Jira Authenticator version history
Okta LDAP agent version history
Okta MFA Credential Provider for Windows version history
Okta On-prem Connector version history
Okta On-Prem MFA agent version history
Okta Oracle Access Manager Plugin Version History
Okta People Picker for Sharepoint agent version history
Okta Provisioning agent and SDK version history
Okta RADIUS Server agent version history
Okta SSO IWA Web App version history
Okta Secure Access Monitor plugin version history
Validate agent downloads
Documentation for end users
Upgrade to Identity Engine
Migrate policies and apps from Microsoft Entra ID to Okta
Migration tasks
Prepare for the migration
Migrate policies
Migrate apps
Configure bookmark apps
Complete your Okta setup
Glossary
Search Okta Docs