Administrators

Administrators (or Admins) are Okta users with permission to access the Okta administration application. You can grant Admins access to all sections of the application, or limit their access to only certain apps.

To add an administrator, do the following:

  1. Click the Add Administrator button.
  2. Enter the name of the administrator granted permissions.
  3. Define the administrator permissions by choosing an administrator role. For a full description of each of the adminAn abbreviation of administrator. This is the individual(s) who have access to the Okta Administrator Dashboard. They control the provisioning and deprovisioning of end users, the assigning of apps, the resetting of passwords, and the overall end user experience. Only administrators have the Administration button on the upper right side of the My Applications page. roles and their permissions, see the table below or click the View permissions info button.
  4. Once the fields are complete, click the Save button.

The table below details the permissions granted to each role. Please note the following:

EA — Early Access features require enablement from Okta Support.

* Permissions apply only to groupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups. that the Group Admin is allowed to manage.

** Can create new users in groups that Group Admin manages.

^ Permissions apply only to applications the AppAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. Admin is allowed to manage. You cannot specify individually created Template apps. Instead, you must choose the entire Template class; for example Template SAMLAn acronym for Security Assertion Markup Language, SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). The SAML standard addresses issues unique to the single sign-on (SSO) solution, and defines three roles: the end user, the IDP, and the SP. 2.0. Also, App Admins cannot edit VPN Notifications settings for VPN-required apps.

+ To complete the end-to-end scenario for setting up social authentication you must

• Be a Super Administrator

• Have both the App Administrator and OrgThe Okta container that represents a real-world organization. Administrator roles

You can restrict the App Administrator role to OpenID Connect clientEssentially, a client is anything that talks to the Okta service. Within the traditional client-server model, Okta is the server. The client might be an agent, an Okta mobile app, or a browser plugin. apps.

App Administrator role

This is an Early Access feature. To enable it use the Early Access Feature Manager as described in Manage Early Access Features.

Okta distinguishes between an application and the instances of that application. An app admin can be granted access to all instances of an app, or just specific instances of that application. This allows for more granular access control.

Super Admins can navigate to Security > Administrators to assign applications or specific instances of applications to App Admins. To distinguish between an application and its instances, Okta refers to the application as the "App" and the instances of that application are called "app instances". For example, Workday would be the App, and each instance of Workday would be referred to as an "app instance".

Note: If you assign a specific instance to an app admin and then later try to assign access to the overall App, an error message displays to warn you of the conflicting permissions. An app admin should not have restricted access to only one specific instance but also be assigned access to the entire app type.

Permission
Super Admin
Org. Admin
App. Admin
Read-Only Admin
Mobile Admin
Org-wide Settings
View and run reports Yes Yes No No Yes Yes No No
View Okta settings (themes, logo, & contact info) Yes Yes No No Yes Yes No No
Manage Profile Editor Yes Yes No Yes No No No Yes (for OIDC clients)
Manage profile mappings Yes Yes Yes Yes No No No Yes (for OIDC clients)
Edit Okta settings Yes Yes No No No No No No
Add, remove, and view administrators Yes No No No No No No No
Add, delete, and edit scopeA scope is an indication by the client that it wants to access some resource., claim, and policy on an authorization server Yes No No No No No No Yes
View authorization server scope, claim, and policy Yes Yes No No Yes No No Yes
View System Log Yes Yes No Yes Yes Yes No Yes
User Management
View users Yes Yes Yes* Yes Yes Yes Yes Yes
Activate & deactivate users Yes Yes Yes* No No No No No
Edit profiles Yes Yes Yes* No No Yes No No
Password resets, MFA resets Yes Yes Yes* No No No Yes No
Create users Yes Yes Yes* No No No No No
Clear user session Yes Yes Yes No No No Yes No
Choose not to receive email notifications about locked user accounts Yes Yes Yes* Yes Yes Yes No Yes
Groups
View groups Yes Yes Yes* Yes Yes Yes No Yes
Add users to groups Yes Yes Yes** No No No No No
Remove users from groups Yes Yes Yes No No No No No
Create groups Yes Yes No No No No No No
Delete groups Yes Yes No No No No No No
Applications
View applications or application instances Yes No No Yes^ Yes Yes No Yes (for OIDC clients)
Add and configure applications Yes No No Yes^ No No No Yes (for OIDC clients)
Assign user access to applications Yes No No Yes^ No No No Yes (for OIDC clients)
Create users in pending status via app import Yes No No Yes^ No No No No
Mobile Policies
View and manage devices Yes Yes No No No Yes No No
Configure Okta mobile manager Yes Yes No No No Yes No No
View policies (Mobile) Yes Yes No No Yes Yes No No
Setting APNS Yes Yes No No No Yes No No
Add/update/delete policies Yes Yes No No No Yes No No
Add/Update/Delete Rules Yes Yes No No No Yes No No
Drag and Drop Policies for prioritization Yes Yes No No No Yes No No
OMMAn acronym for Okta Mobility Management. OMM enables you to manage your users' mobile devices, applications, and data. Your users enroll in the service and can then download and use managed apps from the Apps Store. Managed apps are typically work-related, such as Box or Expensify. As an administrator, you can remove managed apps and associated data from users' devices at any time. You can configure policies, such as data sharing controls, on any of your managed apps. See Configuring Okta Mobility Management for more information. - Wifi (EA)
View wifi policies Yes Yes No No Yes Yes No No
Add/update/delete policies Yes Yes No No No Yes No No
Add/update/delete rules Yes Yes No No No Yes No No
Drag and drop policies for prioritization Yes Yes No No No Yes No No
Mobile Devices
View Mobile tab on users section Yes Yes No No Yes Yes No No
View device details Yes Yes No No Yes Yes No No
Deprovision/clear PC/remote lock/reset Yes Yes No No No Yes No No
Deprovision/reset from Mobile tab Yes Yes No No No Yes No No
OMM - Applications
View Mobile tab on apps Yes No No Yes Yes Yes No No
Edit and save EAS settings Yes No No No No Yes No No
Edit native Mobile Access check boxes Yes No No No No Yes No No
Okta Sign-On
View Okta Sign-On policies Yes Yes No No Yes Yes No No
Add/update/delete policies Yes Yes No No No Yes No No
Add/update/delete rules Yes Yes No No No Yes No No
Drag and drop policies for prioritization Yes Yes No No No Yes No No
Edit MFA factors Yes Yes No No No Yes No No
OpenID Connect End-to-End Scenario+
Create and modify an OIDC App, including registering an OAuth client.
Can be restricted to OIDC client apps.
Yes No No Yes No No No Yes
Add a social IDPAn acronym for Identity Provider. It is a service that manages end user accounts analogous to user directories such as LDAP and Active Directory, and can send SAML responses to SPs to authenticate end users. Within this scenario, the IdP is Okta. Yes Yes No No No No No No
Read-only access to OAuth clients through the API Yes Yes No No No No No Yes
MFA
Enable MFA for the Admin Dashboard Yes No No No No No No No
API Tokens
Create User Tokens Yes Yes Yes No Yes No No No
View User Tokens Yes Yes Yes No Yes No No No
Clear User Tokens Yes Yes No No No No Yes No
View User Social Tokens Yes Yes Yes Yes No No No No
Manage Tokens Yes Yes No No Yes No No No
Top