Okta Integration

Learn how to collect evidence from Okta using Strike Graph's flexible Bridge integration

Written By Micah

What is the Okta Integration?

The Okta integration allows you to use Strike Graph's Bridge-style integration to collect evidence directly from the Okta management API for your compliance needs. This integration uses an API token generated in your Okta admin console, giving you access to user directories, group configurations, authentication policies, application assignments, and more.

Identity and access management is central to most compliance frameworks, and the Okta integration makes it easy to collect and maintain evidence that your organization's access controls are properly configured and enforced.

With this integration, you can gather evidence from Okta, including:

  • User directories and account status

  • Group membership and assignments

  • Authentication and password policies

  • Application assignments and SSO configurations

  • System log events

  • Multi-factor authentication enrollment

Evidence collection is read-only: Strike Graph will never create, modify, or delete users, groups, policies, or any other resources in your Okta organization.

Two Ways to Collect Evidence from Okta

The Okta integration supports two evidence collection methods:

Okta API requests let you call specific Okta management API endpoints and collect the response as evidence. This approach gives you full control over exactly which endpoint to call and what parameters to include.

Script Runner provides curated, pre-built scripts that handle common evidence collection scenarios. Scripts can combine multiple API calls, filter and format the output, and produce evidence that is ready for auditor review. Script Runner is equally powerful to direct API requests and is often the faster path to well-formatted evidence.

If your organization has access to Script Runner, both options appear as tabs when you attach evidence using this integration.

Setting Up the Okta Integration

Prerequisites

  • An Okta organization with admin console access

  • Appropriate permissions within Strike Graph to manage integrations

Step 1: Create an API token in Okta

  1. Sign in to your Okta admin console.

  2. Navigate to Security > API > Tokens.

  3. Click Create Token and give it a descriptive name (for example, "Strike Graph Evidence Collection").

  4. Copy the token value immediately — Okta only shows it once.

The token inherits the permissions of the admin who creates it, so a dedicated read-only service account is recommended. This limits what the token can access and avoids disruption if the creating user's account changes.

For more information, see the Okta API token documentation.

Step 2: Connect Okta in Strike Graph

  1. Navigate to Integrations in the main Strike Graph menu.

  2. Find the Okta integration card and click Add Integration.

  3. Enter your Okta Domain: this is the org domain assigned to your Okta organization, typically in the format yourcompany.okta.com. Accepted domain suffixes include .okta.com, .oktapreview.com, .okta-emea.com, and .okta-gov.com. Enter the domain without https://.

  4. Paste your API Token into the provided field.

  5. Click Save.

Note about custom domains: If your organization uses a custom sign-in domain (for example, login.yourcompany.com), use your Okta org domain here instead (for example, yourcompany.okta.com). The org domain continues to work alongside a custom domain, and the management API is always accessible at the org domain.

Once connected, your Okta integration will appear in the integration list with an "Active" status. The integration name will include your Okta domain (for example, "Okta (yourcompany.okta.com)").

Collecting Evidence Using Okta API Requests

Step 1: Select an evidence object

  1. Navigate to the evidence object where you want to add Okta data.

  2. Click the Attach button to open the attachment options (or configure Automated Collection).

  3. Select your Okta integration from the list of available sources.

Step 2: Configure your API request

The Okta evidence collection form has two main components:

HTTP Method

Okta evidence collection supports GET requests only. Although the Okta management API supports write operations, Strike Graph restricts evidence collection to read-only requests.

API Route

Enter the Okta API route you want to access. Review the Okta API documentation for the full list of available endpoints. The base URL is handled by the integration (based on your Okta domain), so you only need to provide the route.

Example API routes:

  • api/v1/users — Get all users in your Okta organization

  • api/v1/users?filter=status%20eq%20%22ACTIVE%22 — Get active users only

  • api/v1/groups — Get all groups

  • api/v1/groups/{groupId}/users — Get members of a specific group

  • api/v1/apps — Get all application integrations

  • api/v1/policies?type=PASSWORD — Get password policies

  • api/v1/policies?type=OKTA_SIGN_ON — Get sign-on policies

  • api/v1/logs — Get system log events

Note: Replace placeholder values like {groupId} with actual IDs from your Okta organization. You can find these by first running a request to the parent resource (for example, api/v1/groups to get group IDs).

Step 3: Submit your request

  1. Click Submit to execute the API request.

  2. Strike Graph will process your request and collect the data.

  3. Once complete, the evidence will be attached to your evidence object.

Collecting Evidence Using Script Runner

If your organization has Script Runner enabled, a Scripts tab will appear alongside the Okta tab when attaching evidence.

Script Runner provides pre-built scripts tailored to common compliance evidence needs. To use Script Runner:

  1. Navigate to the evidence object and open the attachment options.

  2. Select your Okta integration.

  3. Switch to the Scripts tab.

  4. Search for a script that matches your evidence needs, or describe what you're looking for.

  5. Select a script to preview its details and expected output.

The integration's Okta domain is already stored from setup, so Script Runner scripts will automatically connect to the correct Okta organization without requiring you to enter it again at run time.

For more details on using Script Runner, see the Script Runner overview.

Troubleshooting

Invalid API token

If you receive authentication errors, your API token may have been revoked, the creating user's account may have been deactivated, or the token may have been inactive for more than 30 days (Okta deactivates tokens that are unused for this period).

  1. Click the Reconnect button next to your Okta integration in the Integrations Manager.

  2. Enter your Okta domain and a current API token.

  3. Try your evidence collection again.

Wrong Okta domain

If you receive errors when making API requests, verify that you entered the correct Okta org domain. The domain must end in .okta.com, .oktapreview.com, .okta-emea.com, or .okta-gov.com. If you entered a custom sign-in domain, reconnect using your org domain instead.

Insufficient permissions

The API token inherits the permissions of the admin who created it. If requests return empty results or permission errors, confirm that the token's creating user has read access to the resources you are trying to collect. A super admin or org admin token will have the broadest access, though a read-only admin role is sufficient and recommended.

Rate limiting

Okta enforces rate limits on API requests. If you encounter a rate limit error, wait a few minutes before trying again. This is most likely to occur when collecting from high-volume endpoints like system logs or large user directories.

Missing or incomplete data

If your evidence collection succeeds but doesn't include the data you expected:

  • Verify the API route matches an endpoint in the Okta API documentation.

  • Some endpoints support filtering with query parameters (for example, ?filter=status eq "ACTIVE"). See the Okta documentation for available filter expressions.

  • Confirm that the Okta organization you connected is the one that contains the data you need.

Need More Help?

If you encounter any issues with your Okta Bridge integration or have questions about specific API endpoints, please contact our support team through the in-app messenger. We're here to help you make the most of your compliance automation.