Okta

Flow uses this integration to manage Okta users, groups, factors, app assignments, and log-event reads from automations. Okta does not sync device inventory; see Okta assets for asset posture.

Client credentials

Prepare in Okta

Create an API Services app

In Okta Admin Console, open Applications, then Applications. Choose Create App Integration, select API Services, and create the app.

Configure private key auth

On the app’s General tab, set client authentication to Public key / Private key. Add or generate a key, copy the private key JSON Web Key (JWK) immediately, and leave Proof of possession (DPoP) turned off.

Grant Okta API scopes

Open the app’s Okta API Scopes tab and grant the scopes for the actions this team will use. Use the table below to match scopes to actions.

Assign an admin role

Open the app’s Admin roles tab and assign a role with permissions for the selected actions. Okta scopes limit the token, but the app’s admin role controls what it can do.

Connect in Flow

Find the Okta integration

Open Integrations.
Choose Add connection.
In Add connection, search for Okta.
Select the Okta card.

Open Flow

Connect

Pick the team that will use the connection.
Select the Okta actions that team’s automations need.
Enter the Okta domain hostname, Client ID, private key JWK, and granted scopes when prompted. Use the bare hostname, for example yourcompany.okta.com.

Permissions and scopes

Flow requests scopes during setup based on the actions allowed on the connection. At runtime, Flow checks action access and granted scopes before calling the provider.

Scope	Used by actions
`okta.apps.manage`	Assign user to app, Unassign user from app
`okta.apps.read`	List applications
`okta.groups.manage`	Assign user to group, Unassign user from group
`okta.groups.read`	List group users
`okta.logs.read`	List log events
`okta.users.manage`	Create phone enrollment, Create user, Deactivate user, Enroll factor, Reset factors, Reset password, Suspend user, Unenroll factor, Unlock user, Update user
`okta.users.read`	List app links, List user groups

Supported actions

Action	Description
Assign user to app	Updates or triggers an Okta user to an application using automation-provided input. Use it after the automation has selected the target record or command.	high
Assign user to group	Updates or triggers an Okta user to a group using automation-provided input. Use it after the automation has selected the target record or command.	high
Create phone enrollment	Creates an Okta phone authenticator enrollment using automation-provided input. Use it when the automation needs to add this provider record or request.	medium
Create user	Creates an Okta user using automation-provided input. Use it when the automation needs to add this provider record or request.	high
Deactivate user	Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command.	high
Enroll factor	Updates or triggers an Okta factor for a user using automation-provided input. Use it after the automation has selected the target record or command.	medium
List app links	Reads application links assigned to an Okta user. Use it to fetch current provider state without modifying data.	low
List applications	Reads Okta applications. Use it to fetch current provider state without modifying data.	low
List group users	Reads users in an Okta group. Use it to fetch current provider state without modifying data.	low
List log events	Reads Okta System Log events. Use it to fetch current provider state without modifying data.	low
List user groups	Reads groups for an Okta user. Use it to fetch current provider state without modifying data.	low
Reset factors	Updates or triggers factors for an Okta user using automation-provided input. Use it after the automation has selected the target record or command.	high
Reset password	Updates or triggers the password for an Okta user using automation-provided input. Use it after the automation has selected the target record or command.	high
Suspend user	Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command.	high
Unassign user from app	Removes an Okta application assignment for a user. Use it only after the flow confirms the exact target.	high
Unassign user from group	Removes an Okta group membership for a user. Use it only after the flow confirms the exact target.	high
Unenroll factor	Removes an Okta factor from a user. Use it only after the flow confirms the exact target.	high
Unlock user	Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command.	medium
Update user	Updates or triggers an Okta user using automation-provided input. Use it after the automation has selected the target record or command.	medium

Overview

Knowledge

Assets

Ticketing

Automation integrations

Prepare in Okta

Connect in Flow

Permissions and scopes

Supported actions

Overview

Knowledge

Assets

Ticketing

Automation integrations

​Prepare in Okta

​Connect in Flow

​Permissions and scopes

​Supported actions

Prepare in Okta

Connect in Flow

Permissions and scopes

Supported actions