Okta is a cloud-based Identity and Access Management (IAM) platform. Its job is to securely connect users to their applications — from anywhere, on any device.

• Single Sign-On (SSO) — one login, access everywhere
• Multi-Factor Authentication (MFA) — extra security layers
• Lifecycle Management — automate user provisioning/deprovisioning
• API Access Management — secure APIs with OAuth 2.0

SSO lets users authenticate once and access multiple apps without re-entering credentials. Okta acts as the Identity Provider (IdP) using protocols like SAML 2.0, OIDC, and OAuth 2.0. One login → all assigned apps unlocked.

MFA adds extra layers of security beyond just a password. Supported factors include:

• Okta Verify (push notifications / TOTP codes)
• SMS and Voice calls
• Email OTP
• Hardware tokens (YubiKey)
• Biometrics (Face ID, Windows Hello)

MFA policies can be set per app, per group, or per network zone.

The Universal Directory (UD) is Okta's centralized user store — the master identity record for your org. It aggregates users from AD, LDAP, HR systems like Workday, and stores custom attributes. It's the single source of truth across all connected applications.

IdP (Identity Provider) — authenticates the user and issues SAML assertions. Usually, Okta is the IdP.

SP (Service Provider) — the application the user wants to access (e.g. Salesforce). It trusts the IdP's assertion to grant access.

Groups are collections of users used to assign apps in bulk, define MFA policies, push memberships to downstream apps via SCIM, and trigger Workflows automation. They can sync from AD or be created directly in Okta.

• SAML 2.0 — enterprise web app SSO
• OpenID Connect (OIDC) — modern web/mobile apps
• OAuth 2.0 — API authorization
• WS-Federation — legacy Microsoft apps
• RADIUS — network access authentication

Lifecycle Management automates user provisioning and deprovisioning across all connected apps. When someone joins → accounts created. Role changes → access updated. Employee leaves → all accounts deactivated automatically. Okta uses SCIM 2.0 or proprietary connectors for this.

A configured connection between Okta and an application. It defines the SSO protocol used, attribute mappings, provisioning settings, and who gets access. Okta's Application Network has 7,000+ pre-built integrations for apps like Salesforce, Microsoft 365, GitHub, and Workday.

An Okta Org is your dedicated tenant environment (e.g., company.okta.com). Key components:

• Universal Directory — users and groups
• Application Integrations — connected apps
• Sign-On & MFA Policies — access controls
• Authorization Servers — OAuth 2.0
• Admin Console + End-User Dashboard

SAML 2.0 — XML-based, enterprise web apps (Salesforce, ServiceNow). Been around since early 2000s.

OIDC — JSON/JWT-based, modern web, SPAs, and mobile apps. Also enables OAuth 2.0 API flows.

Rule of thumb: Use SAML when the SP requires it. Use OIDC for new apps or when you need API access alongside authentication.

Also called Risk-Based MFA. It uses contextual signals to decide when to challenge the user instead of always requiring MFA. Signals include device trust, location, IP address, network zone, and time of day. Okta's ThreatInsight feeds IP reputation data into these decisions.

SCIM (System for Cross-domain Identity Management) is an open REST/JSON standard for automating user provisioning. Okta acts as the SCIM client, pushing user create/update/deactivate events to SCIM-compliant apps via standard endpoints like /Users and /Groups.

Okta as IdP: Okta authenticates the user and sends assertions to Service Providers (e.g., Salesforce receives a SAML assertion from Okta).

Okta as SP: Okta trusts an external IdP (like Azure AD or ADFS) to authenticate users. Common in M&A scenarios or chained SSO.

Okta uses the Okta AD Agent, installed on-premises, which creates a secure tunnel to Okta's cloud. Through it: users/groups sync from AD, AD is mastered as the source, Okta can write back attributes, and unlock accounts. The agent polls AD for changes at configurable intervals.

Configured per application with if-then condition rules. Example: "If user is outside corporate network → require MFA." Conditions can be based on group membership, network zone, or device posture. The policy determines the required assurance level for access.

Org AS — built-in, for Okta's own APIs, limited customization.

Custom AS — created per use case, supports custom scopes, claims, policies, and token lifetimes. Multiple per org. Always use Custom AS for external API authorization.

Okta's threat intelligence layer that analyzes auth events across its entire customer base. It identifies IPs associated with credential stuffing, phishing, and bot attacks. Configure it in Audit (log only), Block (deny), or Block + Notify modes.

A no-code automation platform built into Okta — like Zapier for identity. Uses a visual flowchart editor with connectors to Slack, ServiceNow, Google Workspace, and more. Common uses:

• Welcome email when user is provisioned
• Revoke all tokens on offboarding
• Sync custom attributes between systems
• Create a ticket on access request

Device Trust verifies that a device is managed and compliant before granting access. macOS/Windows devices get a certificate via MDM (Jamf/Intune). Mobile devices are checked via Okta Verify + MDM enrollment. Auth policies can then require a trusted device — if not enrolled, access is blocked. Core Zero Trust principle.

PKCE (Proof Key for Code Exchange) replaces client secrets for public clients (browser apps, mobile). Flow:

• Client generates a code_verifier + hashed code_challenge
• Sends challenge in /authorize request → Okta returns an auth code
• Client exchanges code + original verifier (not a secret) at /token

Why better for SPAs? No secure place to store a client secret in the browser. PKCE eliminates this risk with a one-time verifier generated fresh each time.

Three main approaches:

• Single Org, multiple OIDC apps — one app per tenant with custom domains. Simpler, less isolation.
• Separate Orgs per tenant — dedicated orgs via Organizations API. Best for strict data isolation.
• Hub-and-Spoke — central Hub org manages policy; Spoke orgs are tenants that federate back to Hub. Custom AS handles per-tenant token issuance.

Choose based on isolation requirements, compliance needs, and scale.

"Never trust, always verify" — regardless of network location. Okta covers four layers:

• Identity — MFA, passwordless, phishing-resistant FIDO2
• Device — Device Trust, Okta Device Access, MDM posture
• Network — Network Zones, ThreatInsight, Private Access
• Application — Per-app auth policies with risk signals

Okta issues JWTs signed with RS256 or ES256. Proper validation must check:

• Signature — via JWKS endpoint public key
• iss (issuer) — matches your Okta AS
• aud (audience) — matches your application
• exp (expiry) — token hasn't expired
• nonce — prevents replay attacks

Session Cookie — browser-based, controls the Okta session (default 2 hours). Keeps you logged into the Okta dashboard.

Access Token — short-lived JWT (~1 hour), used to authorize API calls. Stateless — resource server validates without calling Okta.

Refresh Token — long-lived opaque token for getting new access tokens without re-auth. Requires offline_access scope. Always use rotating refresh tokens.

JIT creates a user in Okta on their very first login — no pre-creation needed. Configured in Okta's IdP settings: enable JIT, map IdP attributes to Okta profile, set default group assignment for new users. Especially useful for partner and B2B federations where you don't control the identity source.

Based on Apache Commons JEXL. Used in attribute mappings, group rules, and policy conditions. Example:

user.login.contains('@contractor.com') ? 'Contractor' : appuser.department

Supports string manipulation, conditionals, date functions, and array operations — powerful transformations without backend code.

• Exponential backoff on 429 responses (check Retry-After header)
• Use Event Hooks or System Log API instead of polling
• Client-side caching of user/group data
• Use bulk operations where available (Group Push, SCIM bulk)
• Monitor x-rate-limit-* response headers proactively

Okta is built on AWS with multi-AZ deployment and a Cell architecture (limits blast radius). Key facts: 99.99% SLA, HealthInsight dashboard for tenant health. Your biggest DR risk is on-prem dependencies (AD agents, RADIUS agents). Deploy multiple AD agents for redundancy and cache OIDC/SAML metadata in your apps.

Uses device-bound cryptographic keys:

• Okta Verify registers the device and creates a private key stored in the device's secure enclave — never leaves the device
• At login, Okta sends a cryptographic challenge
• Device signs the challenge with the private key, confirmed by biometric (Face ID, fingerprint, Windows Hello)
• Okta verifies the signature using the stored public key

Phishing-resistant — no credentials to steal. Also integrates with WebAuthn for platform authenticators.

• Check the Okta System Log for failed auth events or policy denials for that user
• Verify Device Trust policy — new laptop likely doesn't have the Okta device certificate enrolled yet
• Have the user install Okta Verify and register through MDM (Jamf/Intune) or BYOD enrollment
• If MFA factors are lost — admin resets them in User Profile → Reset MFA
• Post-fix: review Device Trust policy to allow a grace period during device migration windows

• Assess: map their apps, users, groups, and current identity flows
• Short-term: configure Azure AD as an inbound IdP in Okta — their users auth to Azure AD, Okta accepts the SAML assertion. Minimal user disruption.
• Gradually move SaaS apps to Okta SSO in waves, not all at once
• Use JIT provisioning for Azure users as a bridge during migration
• Long-term: consolidate into a single Okta Org and decommission the Azure AD federation

Root cause: Deprovisioning only deactivated Okta accounts — it did NOT revoke already-issued OAuth tokens.

• Enable token revocation on deactivation in Okta's app settings
• Use the API to revoke all user sessions: DELETE /api/v1/users/{id}/sessions
• Automate with Okta Workflows: trigger on user deactivation → revoke all app grants
• Reduce access token lifetime to 15 minutes — limits blast radius
• Enable SCIM deprovisioning so downstream app accounts are also disabled

Phased rollout in 5 stages:

• Phase 1 (Wk 1-2): Assess — inventory apps, OS versions, MDM coverage
• Phase 2 (Wk 3-4): Pilot — enable FastPass for IT team, enroll via MDM, test critical apps
• Phase 3 (Wk 5-8): Migrate from SMS/Email OTP to Okta Verify + phishing-resistant policy
• Phase 4 (Wk 9-12): Enforce org-wide, train help desk on enrollment issues
• Phase 5: Remove password factor option from sign-in policies entirely

• Parallel Run — keep legacy IAM running; import all users into Okta UD via bulk CSV or API
• Hashed Password Import — use Okta's inline password hashing. On first login, Okta verifies hash vs legacy system, stores credential natively. No password reset emails needed.
• Gradual Cutover — enable Okta SSO for new apps first. Migrate by department/app/region in waves.
• IdP Routing Rules — direct users by domain or attribute to correct auth path during transition
• Validation — monitor System Log constantly; define a 99.9% success threshold before each wave
• Rollback Plan — keep ability to re-point DNS/SAML metadata back to legacy system if needed
• Decommission — once 100% login success confirmed over a rolling window, shut down legacy IAM