Okta configuration fields

Field	Description
Enable applications	Enabled: Data Access imports Okta applications, in addition to users and groups. You can see which users and groups are assigned to each application. Disabled (default): Data Access imports only users and groups. Okta applications are not synchronized with Data Access, so you cannot see which users and groups are assigned to each application. Note Enable this option if you want to manage access to your Okta applications from Data Access. The Okta data source in Data Access shows each application as a child data object. For each application that has assigned users or pushed groups, Data Access also creates an access control that lists them. You can add or remove beneficiaries in the access control, and Data Access applies the change in Okta. You can use the Include applications and Exclude applications fields to limit which applications are imported.
Enable group editing	Enabled: Okta groups become manageable in Data Access. Disabled (default): Okta groups are read-only in Data Access. Note Only native Okta groups (type `OKTA_GROUP`) are manageable. App-assigned groups (`APP_GROUP`) and built-in groups (`BUILT_IN`) are always read-only.
Exclude applications	A list of applications to exclude from the synchronization (sync). You can use regular expressions (for example, `TEST.`) to match multiple applications at once. Example The expression `TEST.` excludes every application whose name starts with `TEST`. The expression `TEST` excludes only an application that is named exactly `TEST`. It does not match `TEST-app`, because an expression needs to match the entire name. Note Expressions need to match the entire application name, and they are case-sensitive. To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, `(dev\|test\|sandbox)-.*`. Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from the sync.
Include applications	A list of applications to include in the sync. If you specify any, Data Access imports only matching applications. You can use regular expressions (for example, `TEST.*`) to match multiple applications at once. The same name matching and expression rules apply as for Exclude applications.
Application data source mapping	A list that maps Okta applications to Data Access data sources. This mapping allows Data Access to show which groups Okta provisions to which data sources. Each entry requires both of the following values: Application ID: The ID of the Okta application. Data source ID: The ID of an existing data source in Data Access. For each mapped application, the connector reads the Group Push mappings that have the status `ACTIVE`. Group Push is an Okta feature that provisions groups to external applications through System for Cross-domain Identity Management (SCIM). Note This field is optional. If you leave it empty, no links are created. Application data source mapping works even if the Enable Applications option is disabled.
Exclude groups	A list of groups to exclude from the sync. You can use regular expressions (for example, `TEST.`) to match multiple groups at once. Example The expression `TEST-.` excludes every group whose name starts with `TEST-`. The expression `TEST-` excludes only a group that is named exactly `TEST-`. It does not match `TEST-app`, because an expression needs to match the entire name. Note Expressions need to match the entire group name, and they are case-sensitive. To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, `(Finance\|HR\|Legal)`. Exclusion takes priority over inclusion. If a group is specified in both the Exclude groups and Include groups fields, it is excluded from the sync.
Include groups	A list of groups to include in the sync. If you specify any, Data Access imports only matching groups. You can use regular expressions (for example, `TEST.*`) to match multiple groups at once. The same name matching and expression rules apply as for Exclude groups.
Tag overwrite key for owners	Okta does not use this field. You can leave it empty.
Tag key and value to flag user as a machine	A tag key and tag value that determine whether an identity is classified as a machine user in Data Access. Enter the key-value pair, separated by a colon: `key:value`. If a tag on a user matches the specified pair, that user is set as a machine user instead of a human user. Example If you enter `Department:Automation`, any user whose Okta department is `Automation` is classified as a machine user in Data Access. Note The pair needs to contain exactly one colon, which separates a non-empty key from a non-empty value. The key and value cannot contain a colon, and they are not case-sensitive. The key needs to be one of the following user attributes: `Department` `Division` `Organization` `CostCenter` `CountryCode` `State` `City` `Title`
Exclude statuses	A list of Okta user statuses to exclude from the identity sync. Users with a matching status are skipped and not imported. The values are not case-sensitive, and surrounding spaces are trimmed. Note Common Okta statuses include `ACTIVE`, `STAGED`, `DEPROVISIONED`, and `SUSPENDED`. These statuses come from Okta, not from Data Access. By default, users whose Okta status is `DEPROVISIONED` or `SUSPENDED` are excluded from the sync. If you enter your own statuses, only those statuses are skipped, and the default statuses no longer apply. This field cannot be left empty to import everyone: an empty field means that the default values (`DEPROVISIONED` and `SUSPENDED`) are still used. If you want `DEPROVISIONED` and `SUSPENDED` to be included in the sync, enter a different status that you do not mind skipping, such as `STAGED`.

Enable applications

Enabled: Data Access imports Okta applications, in addition to users and groups. You can see which users and groups are assigned to each application.
Disabled (default): Data Access imports only users and groups. Okta applications are not synchronized with Data Access, so you cannot see which users and groups are assigned to each application.

Note Enable this option if you want to manage access to your Okta applications from Data Access.

The Okta data source in Data Access shows each application as a child data object.
For each application that has assigned users or pushed groups, Data Access also creates an access control that lists them. You can add or remove beneficiaries in the access control, and Data Access applies the change in Okta.
You can use the Include applications and Exclude applications fields to limit which applications are imported.

Enable group editing

Enabled: Okta groups become manageable in Data Access.
Disabled (default): Okta groups are read-only in Data Access.

Note Only native Okta groups (type OKTA_GROUP) are manageable. App-assigned groups (APP_GROUP) and built-in groups (BUILT_IN) are always read-only.

Exclude applications

A list of applications to exclude from the synchronization (sync). You can use regular expressions (for example, TEST.*) to match multiple applications at once.

Example The expression TEST.* excludes every application whose name starts with TEST. The expression TEST excludes only an application that is named exactly TEST. It does not match TEST-app, because an expression needs to match the entire name.

Note

Expressions need to match the entire application name, and they are case-sensitive.
To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, (dev|test|sandbox)-.*.
Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from the sync.

Include applications

A list of applications to include in the sync. If you specify any, Data Access imports only matching applications.

You can use regular expressions (for example, TEST.*) to match multiple applications at once. The same name matching and expression rules apply as for Exclude applications.

Application data source mapping

A list that maps Okta applications to Data Access data sources. This mapping allows Data Access to show which groups Okta provisions to which data sources. Each entry requires both of the following values:

Application ID: The ID of the Okta application.
Data source ID: The ID of an existing data source in Data Access.

For each mapped application, the connector reads the Group Push mappings that have the status ACTIVE. Group Push is an Okta feature that provisions groups to external applications through System for Cross-domain Identity Management (SCIM).

Note

This field is optional. If you leave it empty, no links are created.
Application data source mapping works even if the Enable Applications option is disabled.

Exclude groups

A list of groups to exclude from the sync. You can use regular expressions (for example, TEST.*) to match multiple groups at once.

Example The expression TEST-.* excludes every group whose name starts with TEST-. The expression TEST- excludes only a group that is named exactly TEST-. It does not match TEST-app, because an expression needs to match the entire name.

Note

Expressions need to match the entire group name, and they are case-sensitive.
To match several naming patterns in one expression, place the alternatives in parentheses, separated by a pipe character, for example, (Finance|HR|Legal).
Exclusion takes priority over inclusion. If a group is specified in both the Exclude groups and Include groups fields, it is excluded from the sync.

Include groups

A list of groups to include in the sync. If you specify any, Data Access imports only matching groups.

You can use regular expressions (for example, TEST.*) to match multiple groups at once. The same name matching and expression rules apply as for Exclude groups.

Tag overwrite key for owners

Okta does not use this field. You can leave it empty.

Tag key and value to flag user as a machine

A tag key and tag value that determine whether an identity is classified as a machine user in Data Access. Enter the key-value pair, separated by a colon: key:value. If a tag on a user matches the specified pair, that user is set as a machine user instead of a human user.

Example If you enter Department:Automation, any user whose Okta department is Automation is classified as a machine user in Data Access.

Note

The pair needs to contain exactly one colon, which separates a non-empty key from a non-empty value. The key and value cannot contain a colon, and they are not case-sensitive.
The key needs to be one of the following user attributes:
- Department
- Division
- Organization
- CostCenter
- CountryCode
- State
- City
- Title

Exclude statuses

A list of Okta user statuses to exclude from the identity sync. Users with a matching status are skipped and not imported. The values are not case-sensitive, and surrounding spaces are trimmed.

Note

Common Okta statuses include ACTIVE, STAGED, DEPROVISIONED, and SUSPENDED. These statuses come from Okta, not from Data Access.
By default, users whose Okta status is DEPROVISIONED or SUSPENDED are excluded from the sync. If you enter your own statuses, only those statuses are skipped, and the default statuses no longer apply.
This field cannot be left empty to import everyone: an empty field means that the default values (DEPROVISIONED and SUSPENDED) are still used. If you want DEPROVISIONED and SUSPENDED to be included in the sync, enter a different status that you do not mind skipping, such as STAGED.

Okta configuration fields

Related topics