Okta Platform 2025/26Workforce Identity CloudCustomer Identity CloudOkta for AI AgentsISPMNon-Human IdentityZero TrustIdentity Security Fabric
Okta Platform Architecture Overview
The Identity Security Fabric — unified control plane for human, machine, and AI identities
Okta operates as a "Sovereign Identity Plane" — a vendor-neutral cloud identity platform that sits between your authoritative sources (HR, AD, LDAP) and your downstream applications (8,200+ in the OIN). It is architected as a layered fabric: Universal Directory masters identity data, the access policy engine evaluates every authentication request against risk signals, lifecycle management automates JML provisioning, and governance + privileged access enforce least privilege. Since 2025, this fabric now extends to non-human identities (service accounts, API keys, AI agents) with the same visibility and governance as human users.
Centralized identity store mastering profiles from HR (Workday, UKG), AD/LDAP, and other sources. Single source of truth for all identity types.
SCIM 2.0Profile MasterCustom Schema
Okta Integration Network
8,200+ pre-built integrations. SAML 2.0, OIDC, SCIM, SWA, and API connectors. Now includes AI agent platform integrations (Agentforce, Copilot Studio, Vertex AI).
8,200+ AppsSAMLOIDCSCIM
Lifecycle Management
Automated Joiner-Mover-Leaver orchestration. HR-driven provisioning/de-provisioning to all connected apps. Zero manual IT tickets.
JMLAuto-ProvisionDeprovision
Okta Workflows
No-code/low-code identity automation. 80+ connector cards. Event hooks for custom triggers. Integrates with ISPM for auto-remediation.
No-Code80+ ConnectorsEvent Hooks
System Log & Event Hooks
Real-time audit trail. Event hooks push on state changes. Log streaming to SIEM (Splunk, Sentinel, Sumo Logic).
Real-timeSIEMCEF
Okta Agents
Lightweight agents bridging on-prem AD, LDAP, RADIUS to cloud. 3-click ISPM integration for AD posture visibility.
Visual graph of auth flows, group hierarchies, permission paths. Surfaces hidden SSO providers and nested AD group analysis.
Graph ViewAuth FlowsAD Nested
AD Integration
Uses existing Okta AD Agent. 3-click setup. Discovers service accounts, maps nested groups, hybrid visibility.
3-ClickHybridEA
Issue Detection
Admin MFA not enforced, stale admins, SSO bypass, shadow IdPs, shared agent credentials. Workflow templates for auto-fix.
Risk PriorityAuto-RemediateWorkflows
Shadow AI Discovery
Browser plugin detects OAuth grants to AI tools. Maps client→resource app relationships. Alerts on unknown agents with critical data access.
OAuth MonitorBrowser Plugin
Reporting
Exportable reports by segment, role, group. Compliance evidence for SOX, SOC2, GDPR, NIS2, DORA audits.
SOXSOC2GDPRExport
End-to-End Identity Data Flows
Visual flows showing how identity data moves through the Okta platform from source to access
HR-to-App provisioning flow: Identity data originates in authoritative sources (Workday, AD, LDAP, CSV, SCIM) and flows into Universal Directory where profiles are mastered with attribute-level sourcing. The group rules engine auto-assigns users to groups based on department, role, or custom attributes. Lifecycle management then SCIM-provisions accounts to all 8,200+ downstream apps. Meanwhile, the access policy layer (sign-on policies, risk engine, device trust, ThreatInsight) evaluates every authentication. Everything feeds into the observability stack (system log, ISPM, OIG, OPA, SIEM export) for continuous governance.
◈
HR → Directory → Policy → Apps → Observability
Full identity pipeline from authoritative source to application access
Single source of truth. Attribute-level sourcing from multiple authorities.
▼
Group Rules
Auto-assign by dept, role, custom attrs
Lifecycle Mgmt
JML automation to all apps
Workflows
Custom no-code automation
▼
Sign-On Policy
Auth rules per app
Risk Engine
Adaptive MFA trigger
Device Trust
MDM + EDR signals
ThreatInsight
IP reputation
▼ SCIM Provisioning ▼
Salesforce
Slack
Jira
GitHub
AWS
8,200+
▼
System Log
Full audit trail
ISPM
Posture monitoring
OIG
Access reviews
OPA
Privileged access
SIEM
Splunk / Sentinel
CRUD operation flow (AI agent orchestrated): A natural language request enters via chat, Slack, or API → the agent classifies the intent and extracts entities → builds an execution DAG with rollback chain → the policy engine (OPA) evaluates RBAC, SoD, and blast radius → if LOW risk, auto-approved; if HIGH risk, routes to human-in-the-loop → pre-flight validation checks for duplicates and license availability → API calls execute against Okta (and optionally Entra in dual-write mode) → read-back verification confirms success → correlation store links IDs → response returned → full audit trail + OTEL metrics + SIEM export + scheduled reconciliation at T+5min.
⬡
AI Agent CRUD Operation Flow
Natural language → intent → DAG → policy → execute → verify → audit
▸
1. Request Intake
"Create user mailto:jdoe@corp.com in Engineering with Jira + GitHub" — via chat, Slack, API, or ServiceNow webhook.
4-node plan: (1) POST /users → (2) PUT /groups/{gid}/users → (3a) PUT /apps/jira/users ∥ (3b) PUT /apps/github/users. Rollback chain + idempotency keys generated.
▼
4. OPA Policy Gate
RBAC + SoD + blast radius. Single user = LOW risk → auto-approved. Batch >50 → HITL approval via Slack.
5. Pre-Flight Validation
User exists check? Group at capacity? App licenses available? All clear → proceed.
▼ Execute ▼
6a. Okta API Calls
POST /api/v1/users → 201. PUT /groups → 204. PUT /apps × 2 → 200. Sequential + parallel execution.
6b. Entra Shadow Sync
If dual-write: POST /v1.0/$batch — user + group + apps. Schema mapped via canonical model. ImmutableId correlation stored.
▼
7. Read-Back Verification
GET users → ACTIVE ✓. GET groups → membership confirmed ✓. App assignments verified ✓.
8. Audit + Reconcile
Full operation logged. OTEL metrics emitted. SIEM forwarded. Drift check scheduled at T+5min.
Best-Practice Authentication Patterns
Visual step-by-step flows for every major authentication mechanism
SAML 2.0 SP-Initiated SSO — the bread-and-butter of Okta workforce SSO. The user hits the app, the SP generates an AuthnRequest redirect to Okta, Okta evaluates the sign-on policy (risk engine + device trust), challenges with MFA if policy requires it, then posts back the signed SAML assertion for the SP to validate and create a session.
Okta Sign-In Widget. Password, FastPass, or passwordless.
→
5. MFA challenge
If policy requires: Okta Verify push, FIDO2, SMS, etc.
→
6. SAML response
Signed SAML assertion with claims. POST to SP ACS URL.
▼
7. SP validates assertion
Verifies XML signature, checks issuer, audience, timestamps, and claim values.
→
8. Session created — access granted
SP creates local session. User has authenticated access. Session lifetime governed by Okta global session policy.
OAuth 2.0 + PKCE — the recommended pattern for SPAs and mobile apps. The app generates a code_verifier, hashes it to a code_challenge (S256), sends the challenge with the /authorize request. Okta authenticates the user and returns an auth code. The app exchanges the code + original verifier at /token. Okta validates by re-hashing the verifier to confirm it matches. This prevents authorization code interception attacks.
◈
OAuth 2.0 Authorization Code + PKCE
Best practice for SPA/mobile: code_verifier → challenge → exchange → tokens
RECOMMENDED▸
1. Generate PKCE pair
App creates random code_verifier (43-128 chars) and computes code_challenge = BASE64URL(SHA256(verifier))
→
2. /authorize + challenge
GET /authorize?response_type=code&code_challenge={hash}&code_challenge_method=S256
▼
3. Login + MFA
Okta Sign-In Widget. User authenticates with configured factors per sign-on policy.
→
4. Redirect + auth code
Okta redirects to callback URL with one-time authorization code.
▼
5. POST /token
App sends code + original code_verifier to Okta token endpoint.
→
6. Validate PKCE
Okta computes SHA256(verifier), compares to stored challenge. Match = legitimate client.
→
7. Tokens issued
Access token + ID token + refresh token. App validates ID token signature and claims.
FastPass + Passkey (Passwordless) — phishing-resistant because the private key never leaves the device. The user opens the app, Okta detects the enrolled device-bound key, challenges Okta Verify, biometrics (Touch ID / Face ID) unlock the key, the device signs the cryptographic challenge, Okta verifies the signature and evaluates device posture (MDM + EDR), then issues tokens. Zero passwords at any step.
Okta Verify prompts Touch ID / Face ID / Windows Hello to unlock private key.
▼
4. Sign challenge
Device private key signs the challenge. Key never leaves the secure enclave.
→
5. Verify + posture
Okta verifies signature with stored public key. Evaluates MDM compliance, OS version, EDR signals.
→
6. Token issued
SAML assertion or OIDC tokens issued. Zero passwords used. Phishing-resistant, device-bound.
Cross App Access (XAA) — AI Agent Authorization — the emerging standard for how AI agents securely connect to applications. A human delegates a task → the agent requests scoped access via XAA → Okta verifies the agent is a registered identity → applies least-privilege, time-bound policy → issues a delegated OAuth 2.0 token → agent calls the target app API with the bearer token → full audit trail logged in ISPM + OIG + system log.
User tells agent to perform an action (e.g., "update CRM record for deal X").
→
2. Request scoped access
Agent sends XAA token request to Okta with required scopes and target app.
→
3. Verify agent identity
Okta confirms agent is registered in Universal Directory with valid ownership.
▼
4. Apply least privilege
Policy enforced: only requested scopes granted. Token time-bound (minutes, not days).
→
5. Agent calls target app
Bearer token in Authorization header. Only permitted actions within scoped access.
→
6. Audit trail
Full operation logged in ISPM + OIG + system log. Drift detection. Compliance evidence.
Zero Trust Architecture with Okta
How Okta components compose into a complete Zero Trust security posture
Zero Trust principle: "Never trust, always verify." Okta implements this across five pillars: Identity verification (Adaptive MFA, FastPass), Device assurance (MDM/EDR signals), Network context (ThreatInsight IP reputation), Application access (sign-on policies per app), and Continuous monitoring (ISPM, system log, OIG). Every authentication is evaluated in real-time — there are no trusted zones.
◈
Zero Trust — Five Pillars Mapped to Okta
▸
1. Identity Verification
Every user/agent authenticates every session. Adaptive MFA evaluates risk. FastPass provides phishing-resistant verification. No implicit trust from prior sessions.
Adaptive MFAFastPassRisk Engine
2. Device Assurance
Device posture evaluated before access: MDM enrollment, OS patch level, disk encryption, firewall, jailbreak detection. CrowdStrike/Jamf/Intune signals integrated.
Device TrustMDMEDR
3. Network Context
ThreatInsight evaluates IP reputation, detects credential stuffing, proactive lockout. Network zones define trusted/untrusted perimeters for policy evaluation.
ThreatInsightNetwork ZonesIP Rep
4. App-Level Access Control
Per-application sign-on policies. Different MFA requirements per app sensitivity. API access management with custom authorization servers, scopes, and claims.
Per-App PolicyCustom Auth ServersScopes
5. Continuous Monitoring
ISPM continuously validates posture. OIG certifies access quarterly. System log streams to SIEM. Anomaly detection via behavior analytics. No "set and forget."
ISPMOIGSIEMContinuous
6. Least Privilege (NHI)
OPA enforces JIT elevation for admin access. XAA provides time-bound scoped tokens for AI agents. OIG certifies NHI entitlements. ISPM detects over-provisioning.
JITXAAOIG CertISPM
Threat Landscape → Okta Defense Mapping
Common identity attack vectors and which Okta capability defends against each
Threat Vector
Attack Description
Okta Defense
Product(s)
Credential stuffing
Automated login attempts with stolen credential databases
Securing AI agents as first-class identities in the identity security fabric (GA April 2026)
Okta's AI agent security framework answers three critical questions: Where are my agents? (discover sanctioned and shadow agents), What can they connect to? (authorize with scoped, time-bound tokens via XAA), and What can they do? (govern with OIG audit trails and ISPM monitoring). The framework treats every agent — from Salesforce Agentforce bots to custom LangChain agents — as a managed identity with the same lifecycle, governance, and observability as human users.
①
Stage 1 — Detect & Discover
ISPM Agent Discovery + NHI inventory + shadow AI detection
▸
ISPM Agent Discovery
Browser plugin captures OAuth consent events. Maps client→resource app relationships. Detects unsanctioned shadow agents. Surfaces agents with permissions to critical data. Expanding to Copilot Studio and Agentforce in FY27 Q1.
Shadow AIOAuth TelemetryBrowser Plugin
NHI Inventory
Single view of all non-human identity types across SaaS, IdP, IaaS, and on-prem AD. Automated risk classification and ownership attribution. Flags when multiple agents share same credentials.
Register agents with risk classification, ownership, purpose, and scope. Same profile management as human identities. Agent OIN integrations for Agentforce, Copilot Studio, Vertex AI, Boomi, DataRobot.
Lifecycle Automation
Automated provisioning and decommissioning. Credential rotation policies. Expiration-based access with auto-revocation. Okta Workflows for custom onboarding sequences.
Apply access policies
③
Stage 3 — Authorize & Protect
XAA scoped tokens + OPA for static credentials
▸
Cross App Access (XAA)
Open protocol replacing static credentials with delegated OAuth 2.0. Scoped, time-bound tokens. Vendor-neutral — works across agent platforms.
OPA for Agent Credentials
For agents that can't use XAA: OPA vaults static credentials, provides JIT elevation, automatic rotation. Ensures least privilege even with legacy auth.
Access certification campaigns for agent entitlements. Comprehensive audit trails for all agent actions. SoD enforcement across human + agent permissions. Terraform-managed.
Every NHI type, risk profile, and Okta security control
Non-human identities outnumber humans 45:1 in a typical enterprise. They include service accounts (often with static passwords and no MFA), API keys/tokens (long-lived, broadly scoped), AI agents (operating at machine speed with high privileges), RPA bots (bypassing SSO), cloud workloads (AWS roles, Azure Managed Identities), and break-glass accounts (emergency access with god-mode privileges). Okta's platform now brings each type into the identity security fabric with consistent visibility, governance, and automation.
Long-lived credentials. No expiration, no rotation, broad scope. OPA rotates, ISPM monitors usage.
AI Agents
Autonomous. Machine speed. High privileges. Ephemeral lifecycles. Secured via XAA + Universal Directory.
RPA Bots
UiPath, Power Automate. Bypass SSO/MFA. Need identity lifecycle management.
Cloud Workloads
AWS IAM roles, Azure Managed Identities, GCP service accounts. OPA extending to IaaS in 2026.
Break-Glass Identities
Emergency access. Must be vaulted, monitored, post-use reviewed. OPA provides JIT elevation.
◈
NHI Security Controls (Okta Products)
▸
ISPM → Discover & Assess
Continuous discovery across all connected systems. Risk scoring by privilege, staleness, MFA status, usage. Surfaces orphaned accounts and over-provisioned tokens.
Universal Directory → Register
NHIs as managed identities with ownership, purpose, classification. Custom schema extensions for NHI attributes.
Okta WIC, Entra ID, Google Workspace, Active Directory (on-prem via AD Agent, 3-click setup), GitHub, GitLab, Jira, 300+ OIN SCIM apps. Connector health monitoring with in-line credential editing.
OktaEntraGoogleAD300+ SCIM
Auto-Remediation
Okta Workflows templates via ISPM event hooks: privileged account lockdown, stale credential rotation, orphaned account deprovisioning, MFA enforcement.
Event HooksWorkflowsAuto-Fix
Compliance Reporting
Exportable reports by segment, role, group. Risk-prioritized dashboard with guided remediation. Evidence for SOX, SOC2, GDPR, NIS2, DORA.
Deloitte Digital Identity + Cyber Identity domains mapped to Okta platform capabilities
Deloitte's IAM framework is business-process oriented — it focuses on where digital identities live, what they can access, and which job functions they correspond to. Their approach spans IGA, PAM, AM, CIAM as integrated pillars delivered through a proven methodology with 20+ years of implementation experience. The framework is vendor-agnostic but Okta is listed as a primary technology partner alongside SailPoint, CyberArk, and ForgeRock.
"Keys to the kingdom" — elevated access workflows, session monitoring
Okta Privileged Access (OPA)
GA — Expanding NHI
Pre-Integrated Platform
IGA + AM + PAM pre-integrated to accelerate time to value
Okta Platform (unified WIC + OIG + OPA)
GA — Native
AI + NHI Security
Securing digital workforce — agents, bots, service accounts
Okta for AI Agents + ISPM + XAA
EA/GA Apr 2026
Managed Operations
24/7 service management, change mgmt, optimization
Admin Console + Terraform + API
GA — Full API
Decision Trees — Which Pattern Should I Use?
Guidance for choosing the right authentication and authorization approach
Authentication pattern selection: The right choice depends on your use case (workforce vs. customer vs. machine), your security requirements (phishing resistance, compliance level), and your application type (web app, SPA, mobile, API). Use the decision trees below to navigate to the recommended pattern.