OK
Okta
Provider Setup

Connect Okta

ConfigTrace connects to your Okta org with a read-only API token and monitors the identity, application, and policy configuration that controls who can sign in, what they can access, and who holds administrative privilege.

On this page
  1. Prerequisites
  2. Step 1 — Prepare an Okta API token
  3. Step 2 — Least-privilege guidance
  4. Step 3 — Connect Okta in ConfigTrace
  5. Step 4 — Run your first sync
  6. What ConfigTrace monitors
  7. Security Findings
  8. What ConfigTrace never reads
  9. Known limitations
  10. Troubleshooting

Prerequisites

  • →An Okta org you administer
  • →Permission to create an API token or service app in the Okta Admin Console
  • →A ConfigTrace workspace (owner or admin role)

Step 1 — Prepare an Okta API token

In the Okta Admin Console, go to Security → API → Tokens and create a token. ConfigTrace recommends creating this token under a dedicated read-only administrator account rather than a personal admin account, so it's easy to identify and rotate.

ℹ
The org URL (e.g. your-org.okta.com) and the API token are the only credentials ConfigTrace needs. You can revoke the token at any time from Security → API → Tokens.

Step 2 — Least-privilege guidance

Okta API tokens inherit the permissions of the admin account that created them. Use a dedicated administrator account scoped to the minimum admin role that can read users, groups, applications, and policies — ConfigTrace only issues read (GET) calls and never writes to your org.

⚠
ConfigTrace does not need a Super Administrator token to function. Prefer a role scoped to read access on Users, Groups, Applications, and Security policies where your Okta plan supports custom admin roles.

Step 3 — Connect Okta in ConfigTrace

  1. 1
    Open Integrations
    In the ConfigTrace sidebar, click Integrations, then click Connect on the Okta card.
  2. 2
    Enter your org URL
    Paste your Okta org URL (e.g. your-org.okta.com).
  3. 3
    Paste the API token
    Paste the token from Step 1. ConfigTrace encrypts it before storage and never displays it again.
  4. 4
    Save integration
    Click Save integration. ConfigTrace performs a read-only validation call to confirm the token works.

Step 4 — Run your first sync

Click Sync Now. The first sync captures users, groups, applications, policies, and administrator role assignments as a baseline snapshot — this becomes the reference point for all future diffs.

What ConfigTrace monitors

✓ Reads (configuration metadata)
  • ✓Users, groups, and group membership lifecycle status
  • ✓Applications, app assignments, and SSO configuration (OIDC / SAML)
  • ✓Sign-on and authentication policies
  • ✓MFA and authenticator configuration
  • ✓Password policy: complexity and lockout rules
  • ✓Administrator role assignments and privileged group posture
✕ Never reads
  • ✕Passwords or password hashes
  • ✕MFA/OTP secret seeds
  • ✕Session tokens
  • ✕System Log events or device telemetry
  • ✕End-user application data

Security Findings

Beyond drift, ConfigTrace evaluates Okta configuration against a set of provider-specific Security Findings rules — for example, a sign-on policy that stops requiring MFA, or an identity holding a privileged administrator role. Findings represent current risky configuration posture, not a confirmed compromise. See the risk classification section for how findings are prioritized.

What ConfigTrace never reads

⚠
ConfigTrace monitors configuration, not runtime authentication events. It does not ingest the Okta System Log, does not monitor live sessions, and cannot evaluate the exact effective policy for a specific user at sign-in time — it reads the policy definitions themselves.

For a full breakdown across all providers, see the Data Access & Permissions reference.

Known limitations

  • →No System Log, session, or device-telemetry monitoring
  • →No per-user effective-MFA evaluation — policy definitions are monitored, not per-user runtime outcomes
  • →No password-breach intelligence or runtime attack detection
  • →OAuth service-app authentication is not supported for the connector itself — a static API token is required

Troubleshooting

  • →"Invalid token" on save: Confirm the token hasn't expired or been revoked in the Okta Admin Console — API tokens are revoked automatically after 30 days of inactivity.
  • →"Insufficient permissions" during sync: The admin account that created the token needs read access to Users, Groups, Applications, and Security policies.
  • →Applications section is empty after sync: Confirm the admin account has visibility into the Applications panel in the Okta Admin Console.
  • →To revoke access: In the Okta Admin Console, go to Security → API → Tokens and revoke the token. ConfigTrace stops reading immediately.

For other issues, see the general Troubleshooting guide.