Resource labels
Early Access release. See Enable self-service features.
A resource label is metadata that an org can use to add context to resources in Okta. Admins can use these labels to quickly find resources that fulfill specific requirements and further automate governance configurations. Admins must be assigned a role that includes the View labels permission for labels to be visible in the Admin Console.
Resource labels are defined similarly to (key, value) pairs, except the resource label key is effectively a name that encompasses all the values that belong to it. For example, your org might define a resource label key named Compliance, whose values include SOX, HIPAA, and GLBA. These labels can then be applied to all the resources that satisfy these standards. When a label is applied to a resource, that label appears with the resource in the Admin Console. So when the SOX label is applied to an app, viewing that app in the Admin Console also displays the SOX label.
Each org has a maximum of 10 custom label keys, and each key has a maximum of 10 values. This means that an org can define a maximum of 100 resource labels. In addition, Okta provides two predefined labels: Crown Jewel and Privileged. Each resource can be assigned a maximum of 10 labels. All keys and values are unique across all resource labels in an org, which are case-insensitive.
You can use labels to determine which resources to include for specific purposes. This allows you to include resources that meet a specific criteria by matching labels, rather than manually adding each resource. For example, you might create a campaign that includes all SOX-compliant apps by including all apps that have the SOX label.
You can also create and assign resource labels by using the Labels API. When you delete a resource, any labels assigned to it are removed from that resource.
Filter resources by label
You can use labels to filter resources in the Admin Console. This enables you to quickly find resources that meet a specific set of criteria.
You can filter by resource labels on the following pages:
- The Applications page. In the Admin Console, go to .
- The Advanced search of the Groups page. In the Admin Console, go to .
- The Entitlements tab under the Governance section of an app. In the Admin Console, open the app of interest, click the Governance tab, and then click the Entitlements tab.
You can either filter resources by resource label or by profile attributes, but never both types at the same time.