Okta configuration fields

Field	Description
Enable applications	Enabled: Data Access imports Okta applications, in addition to users and groups. You can see which users and groups are assigned to each application. Disabled (default): Data Access imports only users and groups. Okta applications are not synchronized with Data Access, so you cannot see which users and groups are assigned to each application. Note Enable this option if you want to manage access to your Okta applications from Data Access. The Okta data source in Data Access shows each application as a child data object. For each application that has assigned users or pushed groups, Data Access also creates an access control that lists them. You can add or remove beneficiaries in the access control, and Data Access applies the change in Okta. You can use the Include applications and Exclude applications fields to limit which applications are imported.
Enable group editing	Enabled: Okta groups become manageable in Data Access. Disabled (default): Okta groups are read-only in Data Access. Note Only native Okta groups (type `OKTA_GROUP`) are manageable. App-assigned groups (`APP_GROUP`) and built-in groups (`BUILT_IN`) are always read-only.
Exclude applications	A list of applications to exclude from synchronization. You can use regular expressions (for example, `TEST.`) to match multiple applications at once. Expressions are matched against the application name, which is the Okta label, or the technical name if the application has no label. Expressions need to match the entire application name, and they are case-sensitive. Example The expression `TEST.` excludes every application whose name starts with `TEST`. The expression `TEST` excludes only an application that is named exactly `TEST`. It does not match `TEST-app`, because an expression needs to match the entire name. Note Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from synchronization.
Include applications	A list of applications to include in synchronization. You can use regular expressions (for example, `TEST.*`) to match multiple applications at once. The same name matching and expression rules apply as for as for Exclude applications. Note Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from synchronization.
Application data source mapping	A list that maps Okta applications to Data Access data sources. This mapping allows Data Access to show which groups Okta provisions to which data sources. Each entry requires both of the following values: Application ID: The ID of the Okta application. Data source ID: The ID of an existing data source in Data Access. For each mapped application, the connector reads the Group Push mappings that have the status `ACTIVE`. Group Push is an Okta feature that provisions groups to external applications through System for Cross-domain Identity Management (SCIM). Note This field is optional. If you leave it empty, no SCIM links are created. Application data source mapping works even if the Enable Applications option is disabled.
Exclude groups	A list of groups to exclude from synchronization. You can use regular expressions (for example, `TEST.`) to match multiple groups at once. Expressions need to match the entire group name, and they are case-sensitive. Example The expression `TEST-.` excludes every group whose name starts with `TEST-`. The expression `TEST-` excludes only a group that is named exactly `TEST-`. It does not match `TEST-app`, because an expression needs to match the entire name. Note Exclusion takes priority over inclusion. If a group is specified in both the Exclude groups and Include groups fields, it is excluded from synchronization.
Include groups	A list of groups to include in synchronization. You can use regular expressions (for example, `TEST.`) to match multiple groups at once. The same name matching and expression rules apply as for as for Exclude groups. Example The expression `prod-.` synchronizes only the groups whose names start with `prod-`. The expression `prod-` synchronizes only a group that is named exactly `prod-`. It does not match `prod-app`, because an expression needs to match the entire name.
Tag overwrite key for owners	Okta does not use this field. You can leave it empty.
Tag key and value to flag user as a machine	A tag key and tag value that determine whether an identity is classified as a machine user in Data Access. Enter the tag key-value pair, separated by a colon: `key:value` If a tag on a user has a key-value pair that matches the specified pair, that user is set as a machine user in Data Access, instead of a human user. Example If you enter the tag key-value pair `Department:Automation` in this field, any user in your data source whose Okta `Department` is `Automation` is classified as a machine user in Data Access. The pair needs to contain exactly one colon, which separates a non-empty key from a non-empty value, for example `Department:Automation`. Because the colon is the separator, the key and the value cannot themselves contain a colon. The key and value are not case-sensitive. The key needs to be one of the following Okta user profile attributes. The connector turns these attributes into tags with the source `Okta`. User tags that you define yourself in Okta are not used. `Department` `Division` `Organization` `CostCenter` `CountryCode` `State` `City` `Title`
Exclude statuses	A list of Okta user statuses to exclude from identity synchronization. Users with a matching status are skipped and not imported. The values are case-insensitive, and surrounding spaces are trimmed. Common Okta statuses include `ACTIVE`, `STAGED`, `DEPROVISIONED`, and `SUSPENDED`. These statuses come from Okta, not from Data Access. Note By default, users whose Okta status is `DEPROVISIONED` or `SUSPENDED` are excluded from synchronization. If you enter your own statuses, only those statuses are skipped, and the default statuses no longer apply. This field cannot be left empty to import everyone: an empty field means that the default values (`DEPROVISIONED` and `SUSPENDED`) are still used. If you want `DEPROVISIONED` and `SUSPENDED` to be included in synchronization, enter a different status that you do not mind skipping, such as `STAGED`.

Enable applications

Enabled: Data Access imports Okta applications, in addition to users and groups. You can see which users and groups are assigned to each application.
Disabled (default): Data Access imports only users and groups. Okta applications are not synchronized with Data Access, so you cannot see which users and groups are assigned to each application.

Note Enable this option if you want to manage access to your Okta applications from Data Access.

The Okta data source in Data Access shows each application as a child data object.
For each application that has assigned users or pushed groups, Data Access also creates an access control that lists them. You can add or remove beneficiaries in the access control, and Data Access applies the change in Okta.
You can use the Include applications and Exclude applications fields to limit which applications are imported.

Enable group editing

Enabled: Okta groups become manageable in Data Access.
Disabled (default): Okta groups are read-only in Data Access.

Note Only native Okta groups (type OKTA_GROUP) are manageable. App-assigned groups (APP_GROUP) and built-in groups (BUILT_IN) are always read-only.

Exclude applications

A list of applications to exclude from synchronization. You can use regular expressions (for example, TEST.*) to match multiple applications at once.

Expressions are matched against the application name, which is the Okta label, or the technical name if the application has no label. Expressions need to match the entire application name, and they are case-sensitive.

Example The expression TEST.* excludes every application whose name starts with TEST. The expression TEST excludes only an application that is named exactly TEST. It does not match TEST-app, because an expression needs to match the entire name.

Note Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from synchronization.

Include applications

A list of applications to include in synchronization. You can use regular expressions (for example, TEST.*) to match multiple applications at once. The same name matching and expression rules apply as for as for Exclude applications.

Note Exclusion takes priority over inclusion. If an application is specified in both the Exclude applications and Include applications fields, it is excluded from synchronization.

Application data source mapping

A list that maps Okta applications to Data Access data sources. This mapping allows Data Access to show which groups Okta provisions to which data sources. Each entry requires both of the following values:

Application ID: The ID of the Okta application.
Data source ID: The ID of an existing data source in Data Access.

For each mapped application, the connector reads the Group Push mappings that have the status ACTIVE. Group Push is an Okta feature that provisions groups to external applications through System for Cross-domain Identity Management (SCIM).

Note

This field is optional. If you leave it empty, no SCIM links are created.
Application data source mapping works even if the Enable Applications option is disabled.

Exclude groups

A list of groups to exclude from synchronization. You can use regular expressions (for example, TEST.*) to match multiple groups at once. Expressions need to match the entire group name, and they are case-sensitive.

Example The expression TEST-.* excludes every group whose name starts with TEST-. The expression TEST- excludes only a group that is named exactly TEST-. It does not match TEST-app, because an expression needs to match the entire name.

Note Exclusion takes priority over inclusion. If a group is specified in both the Exclude groups and Include groups fields, it is excluded from synchronization.

Include groups

A list of groups to include in synchronization. You can use regular expressions (for example, TEST.*) to match multiple groups at once. The same name matching and expression rules apply as for as for Exclude groups.

Example The expression prod-.* synchronizes only the groups whose names start with prod-. The expression prod- synchronizes only a group that is named exactly prod-. It does not match prod-app, because an expression needs to match the entire name.

Tag overwrite key for owners

Okta does not use this field. You can leave it empty.

Tag key and value to flag user as a machine

A tag key and tag value that determine whether an identity is classified as a machine user in Data Access. Enter the tag key-value pair, separated by a colon: key:value

If a tag on a user has a key-value pair that matches the specified pair, that user is set as a machine user in Data Access, instead of a human user.

Example If you enter the tag key-value pair Department:Automation in this field, any user in your data source whose Okta Department is Automation is classified as a machine user in Data Access.

The pair needs to contain exactly one colon, which separates a non-empty key from a non-empty value, for example Department:Automation. Because the colon is the separator, the key and the value cannot themselves contain a colon. The key and value are not case-sensitive.

The key needs to be one of the following Okta user profile attributes. The connector turns these attributes into tags with the source Okta. User tags that you define yourself in Okta are not used.

Department
Division
Organization
CostCenter
CountryCode
State
City
Title

Exclude statuses

A list of Okta user statuses to exclude from identity synchronization. Users with a matching status are skipped and not imported. The values are case-insensitive, and surrounding spaces are trimmed.

Common Okta statuses include ACTIVE, STAGED, DEPROVISIONED, and SUSPENDED. These statuses come from Okta, not from Data Access.

Note

By default, users whose Okta status is DEPROVISIONED or SUSPENDED are excluded from synchronization. If you enter your own statuses, only those statuses are skipped, and the default statuses no longer apply.
This field cannot be left empty to import everyone: an empty field means that the default values (DEPROVISIONED and SUSPENDED) are still used. If you want DEPROVISIONED and SUSPENDED to be included in synchronization, enter a different status that you do not mind skipping, such as STAGED.

Okta configuration fields

Related topics