User management

Learn about user management tool scopes, features, and capabilities, with sample workflows and example prompts.

Early Access release

Tool name
okta_user_management
Okta scopes
okta.users.read and okta.users.manage

What you can do

Create and manage user accounts, their resources, and their authentication factors.

User accounts

  • Create user accounts with email, name, and other profile attributes
  • Retrieve user profiles and check account status (ACTIVE, LOCKED_OUT, SUSPENDED, and other states)
  • Update user information like department, phone number, manager, or custom attributes
  • Deactivate user accounts (confirmation required)
  • Permanently delete deactivated users
  • List all users with filtering and pagination

User resources

  • List all groups that a user is a member of
  • List all devices enrolled by a user
  • List all app links for apps assigned to a user directly or indirectly through group membership

User factors

  • List a user's enrolled factors
  • List the factors and security questions a user can enroll
  • Enroll, activate, verify, resend the challenge for, and unenroll a factor
  • Poll a push verification transaction
  • Manage the org's YubiKey OTP token seeds

Key features

  • Paginate through large result sets using a cursor (max 200 users per page)
  • Reduce processing costs with token-optimized responses
  • Restrict actions based on your granted OAuth scopes (okta.users.read and okta.users.manage)

Sample use cases

Use case Prompt Result
Bob Martin, a new manager, is joining and Alice Johnson will report to him on the Sales team. The admin also wants to permanently remove a leftover bobmartin@mcp.com test account after safely deactivating it. Create a manager account for Bob Martin (email bob.martin@company.com, login bob.martin@company.com), update Alice Johnson so her manager is Bob Martin and her department is Sales, then deactivate bobmartin@mcp.com and permanently delete that already-deactivated test account after I confirm. Bob Martin's manager account is created, Alice is reassigned to him with her department set to Sales, and the old bobmartin@mcp.com account is deactivated and then permanently deleted after confirmation. Each change is verified by re-reading the affected users, and the permanent delete runs only on a deactivated account.
Alice is joining the Engineering team on Monday, and the admin wants her account created, added to Engineering, and protected by MFA from her first sign-in. Onboard a new employee named Alice Martin, email alice.martin@company.com, login alice.martin@company.com. Add her to the Engineering group, and create a sign-on policy that requires MFA for the Engineering group.

Alice is created and added to Engineering, and an active MFA sign-on policy is applied to the Engineering group, each step confirmed by re-reading the user, membership, and policy.