Policy management

Understand policy management tool scopes, features, capabilities, sample workflows, and example prompts.

Early Access release

Tool name

okta_access_management

Okta scopes

okta.policies.read and okta.policies.manage

What you can do

• List all authentication, MFA, password, and sign-on policies
• Retrieve detailed policy configurations and rules
• Create policies with specific conditions and actions
• Update existing policies
• Activate or deactivate policies and individual rules
• Create, update, and delete individual policy rules
• Delete policies (requires confirmation)
• Understand policy rule behavior before deployment
• Paginate through policy lists using a cursor
• Manage policies through their full lifecycle
• Restrict actions based on your granted OAuth scopes
• Reduce processing costs with token-optimized responses

Sample use cases

Use case	Prompt	Result
The Finance group just got access to App A, so the admin needs to enforce MFA for the group. The admin also wants to delete the leftover TestPolicy created earlier to clean the policy list, and apply stronger password rules as part of this hardening pass.	Create an authentication policy called Sensitive Access Policy with an active rule that requires MFA for the Finance group on App A. Create a password policy named Finance Password Baseline with rules that require a minimum of 12 characters and include uppercase, lowercase, number, and symbol characters. Then delete my old TestPolicy and show me the remaining policies and created policy rules.	Sensitive Access Policy is created with the Finance MFA rule, Finance Password Baseline is created with the explicit complexity rule set (12+ length, uppercase, lowercase, number, symbol), TestPolicy is deleted, and the remaining policies are listed.
The Finance rule already uses MFA, but the admin wants users to re-verify more often for better security. The admin also wants a basic lockout policy so repeated failed sign-ins are limited and accounts unlock automatically after a short wait.	On the Sensitive Access Policy, update the Require MFA for the Finance rule to keep MFA (2FA) required and shorten re-authentication time, then show me the updated rule. Create a password policy named Workforce Lockout Baseline that locks accounts after five failed attempts and auto-unlocks after 30 minutes. Show me the updated Finance rule and the created password policy rule.	The Finance MFA rule is updated to keep MFA required and use a shorter re-authentication time. A new Workforce Lockout Baseline password policy is created with lockout after five failed attempts and auto-unlock after 30 minutes. The updated Finance rule and lockout settings are shown for confirmation.